AD - Additional Attacks
Last updated
Was this helpful?
Last updated
Was this helpful?
➡️ ZeroLogon is a vulnerability in the cryptography of Microsoft’s Netlogon process that allows an attack against Microsoft Active Directory domain controllers. Zerologon makes it possible for a hacker to impersonate any computer, including the root domain controller.
The Zerologon vulnerability (CVE-2020-1472) is a critical flaw in Microsoft's Netlogon Remote Protocol (MS-NRPC) that affects Active Directory (AD) domain controllers. Zerologon allows an unauthenticated attacker with network access to a domain controller to establish a vulnerable Netlogon session and eventually gain domain administrator privileges.
The vulnerability arises from a flaw in the cryptographic implementation of the Netlogon protocol, enabling attackers to impersonate any computer, including the root domain controller. By exploiting this, an attacker can effectively take over the entire domain.
This is a very dangerous attack, not worth the risk of running it in a pentest.
Proceed with the attack using dirkjanm/CVE-2020-1472: PoC for Zerologon if the target is vulnerable.
➡️ The PrintNightmare vulnerability refers to critical security flaws in the Windows Print Spooler service, identified as CVE-2021-1675 and CVE-2021-34527.
PrintNightmare is a critical remote code execution and local privilege escalation vulnerability that allows attackers to execute arbitrary code with SYSTEM privileges, enabling them to install programs, modify data, or create new accounts with full user rights. Exploitation can occur remotely or locally, even on fully patched systems, if certain registry settings are misconfigured. Microsoft has released patches to address these issues, however, systems with specific registry configurations may remain vulnerable.
The attack was executed on a fully patched Windows Server 2022, and if it failed, it is most likely due to the applied security patches.
The dll may need to be obfuscated to bypass AV detection.
