Domain Controller Zero Day

Rich warren of ncc group released a poc yesterday that allowed him to achieve domain admin in ten seconds.

Domain controller zero day. Protecting companies from zero day exploits and new vulnerabilities such as zerologon. Researchers at preempt uncovered two zero day vulnerabilities within the windows ntlm both of which handle the protocol improperly and could allow attackers to create domain administrator accounts. If an attacker can intercept traffic between a domain controller and a target machine they could create a group policy to grant administrator rights to a standard user.

The january 2021 security update review. 0 domain admin in 10 seconds with zerologon cve 2020 1472. Approximately one week later the device made a large volume of unusual rpc calls to an internal domain controller.

We are reminding our customers that beginning with the february 9 2021 security update release we will be enabling domain controller enforcement mode by default. Looking back at the zero day initiative in 2020. Successful calls to the netlogon service were observed indicating that this was an exploitation of the zerologon vulnerability.

Has highlighted how dangerous a netlogon vulnerability cve 2020 1472 included in the august 2020 patch tuesday release can be to a network. Proof of concept tool lets attackers escalate a hacked inbox to admin on a company s internal domain controller. Microsoft addressed a critical rce vulnerability affecting the netlogon protocol cve 2020 1472 on august 11 2020.

Lazy hackers news portal is the most trusted widely read infosec source of the latest hacking news and zero day attacks for ethical hackers tuesday january 19 2021 about. Microsoft domain controller zerologon vulnerability a recent disclosure by dutch security firm secura b v.