The ZeroLogon vulnerability (CVE-2020-1472) is one of the most critical flaws ever discovered in Active Directory environments. It allows an attacker to gain domain administrator privileges without authentication—a nightmare scenario for any organization.

🧨 What Is ZeroLogon?

ZeroLogon is a vulnerability in the Netlogon Remote Protocol (MS-NRPC), which is used by domain controllers to authenticate users and machines in an Active Directory domain. The flaw stems from a cryptographic implementation error in how Netlogon handles AES-CFB8 encryption.

🧠 How the Attack Works

1. Unauthenticated Access:

   • The attacker sends specially crafted Netlogon messages with zeroed-out values (hence “ZeroLogon”) to a domain controller.

2. Bypass Authentication:

   • Due to the flawed encryption, the attacker can spoof the identity of any machine, including the domain controller itself.

3. Reset DC Account Password:

   • Once impersonated, the attacker can reset the domain controller’s machine account password in Active Directory.

4. Full Domain Compromise:

   • With control over the DC account, the attacker can authenticate as a domain controller and gain full administrative privileges.

⚠️ Why It’s So Dangerous

• No credentials required: The attack is unauthenticated.
• Remote execution: Can be done over the network.
• Full domain takeover: Grants control over all AD resources.
• Fast and stealthy: Exploitation can take seconds and leave minimal traces.

🛡️ How to Protect Against ZeroLogon

• Apply Microsoft’s patch: Released in August 2020 and finalized in February 2021.
• Enable Secure Channel Enforcement:
  • Use the FullSecureChannelProtection registry key to enforce secure Netlogon channels.
• Disable unnecessary services:
  • For example, disable the Printer Spooler on domain controllers to reduce attack surface.
• Monitor for suspicious Netlogon traffic:
  • Look for repeated failed authentication attempts or password resets.

📚 Learn More

• Semperis: What is Zerologon?
• Netwrix: Mitigating Zerologon
• CrowdStrike: Exploit Steps and Prevention