Awesome. Security. Advice.
.png)
A quick post to describe CVE-2020-1472 is a Critical security flaw, christened as “Zerologon”, in Windows Domain controllers, along with exploitation, detection and remediation steps.
The last week has been busy for Windows administrators all around the world applying patches, setting up monitoring and discussing CVE-2020-1472, a CVSS 10 rated Critical remotely exploitable privilege escalation vulnerability in Microsoft Windows’ Netlogon authentication process. Popularly known as “Zerologon”, the vulnerability was discovered by the security firm Secura who published a technical paper describing the vulnerability.
Successful exploitation of the ‘Zerologon’ bug by attackers that can establish a network connection to the Netlogon RPC interface of a vulnerable domain controller allows for a full compromise of the machine and the entire domain from there on. Several Proof of Concept exploitation scripts and tools have already released.
Several detection scripts have now been released with the first being the one by the Secura team. Tenable Nessus, Qualys and other leading vulnerability scanners have added in checks for detection. Additionally, Metasploit will soon have a working auxiliary, along with mimikatz and other PoCs coming up on Github every other day that can be run by attackers out of the box to gain Domain Administrator privileges!
It is speculated that the exploit code could very soon be woven into malware and ransomware that could then be used to infect networks to gain access to data and systems.
Microsoft is fixing this in two phases with the Initial Deployment Phase already started with updates released on August 11, 2020. The Enforcement Phase will begin on February 9th 2021 and will require all Windows and non-Windows devices to use secure RPC with Netlogon secure channel or explicitly allow the account by adding an exception for the non-compliant device through the “Domain controller: Allow vulnerable Netlogon secure channel connections” group policy.
You can download the patches for the Initial Deployment Phase for your version of Windows Server from https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
The most common form of the exploitation PoCs that we have seen changes the domain controller account password to an empty string that is then used to get NTLM hashes from the AD database (ntds.dit) using secretsdump.py or execute commands using tools like wmiexec.py or psexec.py (all tools from the Impacket library). Additionally, attackers could also use the initial access to the DC to obtain the hash of the krbtgt account to create golden tickets that give access to the DC environment even after the patches are in place and passwords have been changed!
Hate filling forms? We're quick to respond to emails and calls too.
