vulnerability · 1597104000000

Zerologon Vulnerability (CVE-2020-1472)

A critical vulnerability in Microsoft's Netlogon Remote Protocol allowed unauthenticated attackers to gain domain administrator privileges.

What happened

Secura researchers discovered a flaw in the ComputeNetlogonCredential function of the Netlogon protocol. The implementation of AES-CFB8 used a fixed initialization vector of 16 zero bytes, allowing an attacker to spoof the identity of a domain controller and set its password to an empty value.

Technical mechanism

The vulnerability exploited a cryptographic flaw where encryption of 8-bytes of zeros could yield a ciphertext of zeros with a 1 in 256 probability. Attackers used this to establish an unsecure Netlogon channel and change the DC password.

Why it matters

Zerologon represents one of the most severe Active Directory vulnerabilities discovered, enabling instant, unauthenticated domain takeover.

Impact

Widespread exposure of Windows domains. Attackers could completely compromise Active Directory authentication.

Response

Microsoft released a security update in August 2020. CISA issued an emergency directive requiring federal agencies to patch immediately.

Defensive lessons

  • Cryptographic implementations must strictly adhere to secure practices (e.g., random IVs).
  • Immediate patching of critical infrastructure components like Domain Controllers is essential.
  • Monitoring for anomalous Netlogon traffic is necessary for detection.

Evidence register

  1. CISA — Microsoft Warns of Continued Exploitation of CVE-2020-1472 (verified)
  2. CVE — CVE-2020-1472 (verified)
  3. CrowdStrike — Zerologon (CVE-2020-1472): An Unauthenticated Privilege Escalation to Full Domain Privileges (verified)