Zerologon (CVE-2020-1472) is a critical flaw in the Netlogon Remote Protocol's use of AES-CFB8: a fixed initialization vector made one in 256 all-zero challenges validate, so an unauthenticated attacker on the network could impersonate a domain controller and reset the DC's machine account password to empty in seconds. From there they perform DCSync and dump every hash, full domain compromise with no credentials. It is fully patched; the fix (August 2020) enforces secure Netlogon. Defend by patching and enforcing secure RPC.
What Zerologon is
Zerologon is a weakness in how the Netlogon protocol used AES-CFB8 encryption. A fixed all-zero initialization vector meant that about one in 256 attempts with an all-zero plaintext produced valid ciphertext, letting an attacker bypass authentication to the domain controller entirely, with nothing but network access to it.
How the attack works
The attacker repeatedly sends Netlogon authentication with zeroed values until one validates (a few seconds), then calls NetrServerPasswordSet2 to set the DC's machine account password to empty. With that they authenticate as the DC and run DCSync (secretsdump.py) to dump the KRBTGT and all account hashes. Note that resetting the DC password can break the DC if not restored, so the technique carries real operational risk. Shown for defensive testing.
How to defend against it
Patch. The August 2020 update, enforced since February 2021, requires secure Netlogon (RPC signing and sealing) and closes the flaw. Confirm no legacy devices depend on vulnerable Netlogon, monitor for anomalous NetrServerPasswordSet2 calls and machine-account password changes on DCs, and treat any DC whose machine password was reset as compromised until proven otherwise.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: CVE-2020-1472 Netlogon Elevation of Privilege(Microsoft)
An unpatched DC is one Zerologon run from full domain takeover. Talk to a security expert about validating your patch and hardening state.