exploiting-zerologon-vulnerability-cve-2020-1472

What problem does it solve? Authorized red team operators and penetration testers need a structured, repeatable procedure to validate whether domain controllers are vulnerable to Zerologon (CVE-2020-1472), demonstrate the impact of the flaw, and confirm that detection controls fire correctly. ## Core Features & Use Cases - Vulnerability Verification: Scan and confirm unpatched domain controllers using nmap, CrackMapExec, and a Zerologon checker before exploitation. - Guided Exploitation Chain: Step-by-step workflow covering the Netlogon authentication bypass, machine account password reset, DCSync with secretsdump.py, and pass-the-hash domain admin access via psexec or wmiexec. - Detection and Remediation Content: Includes Windows Event IDs (4742, 5805, 4624), a Suricata rule, a Sigma rule, and hardening guidance including KB4571694 and enforcement mode. - Use Case: During an authorized Active Directory assessment, an operator uses this workflow to prove a DC is exploitable, dump domain hashes to demonstrate impact, then restore the machine account password to avoid breaking replication. ## Quick Start Ask the agent to check whether the domain controller at a given IP is vulnerable to Zerologon and, if authorized, run the full exploitation and restoration workflow.