/CVE-2020-1472
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
victim10wq3 838f36f0cf
Update README.md
2 years ago
LICENSE Add files via upload 2 years ago
README.md Update README.md 2 years ago
requirements.txt Add files via upload 2 years ago
zerologon_tester.py Add files via upload 2 years ago

README.md

ZeroLogon testing script

A Python script that uses the Impacket library to test vulnerability for the Zerologon exploit (CVE-2020-1472).

It attempts to perform the Netlogon authentication bypass. The script will immediately terminate when succesfully performing the bypass, and not perform any Netlogon operations. When a domain controller is patched, the detection script will give up after sending 2000 pairs of RPC calls and conclude the target is not vulnerable (with a false negative chance of 0.04%).

Installation

Requires Python 3.7 or higher and Pip. Install dependencies as follows:

pip install -r requirements.txt

Note that running pip install impacket should work as well, as long as the script is not broken by future Impacket versions.

Running the script

The script targets can be used to target a DC or backup DC. It likely also works against a read-only DC, but this has not been tested. Given a domain controller named EXAMPLE-DC with a file containing a list of IP address IPlist.txt, run the script as follows:

./zerologon_tester.py EXAMPLE-DC IPlist.txt

The DC name should be its NetBIOS computer name. If this name is not correct, the script will likely fail with a STATUS_INVALID_COMPUTER_NAME error.

A Whitepaper on this vulnerability will be published here: https://www.secura.com/blog/zero-logon on Monday 14 sept.