saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/exploiting-zerologon-vulnerability-cve-2020-1472/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.1 KiB
Raw Blame History

API Reference: Zerologon (CVE-2020-1472)

Vulnerability Overview

  • CVE: CVE-2020-1472
  • CVSS: 10.0 (Critical)
  • Protocol: MS-NRPC (Netlogon Remote Protocol)
  • Port: 135 (RPC)
  • Impact: Domain Admin without credentials

Attack Mechanism

The Netlogon AES-CFB8 implementation uses a static IV of zero bytes. Sending authentication requests with 256 zero bytes succeeds with probability 1/256 per attempt.

Detection Tools

Nmap

nmap -p 135,445 --script smb-vuln-cve-2020-1472 <DC_IP>

Impacket zerologon_tester.py

zerologon_tester.py DC01 10.10.10.1

CrackMapExec

crackmapexec smb <DC_IP> -u '' -p '' -M zerologon

Patch Information

Microsoft KBs

KB OS Version
KB4571694 Windows Server 2016
KB4571703 Windows Server 2019
KB4571723 Windows Server 2012 R2
KB4571736 Windows Server 2012

Registry Key for Enforcement

HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
FullSecureChannelProtection = 1 (DWORD)

MS-NRPC Protocol

NetrServerAuthenticate3

DCERPC call to \PIPE\netlogon
Function: NetrServerAuthenticate3
ClientCredential: 8 zero bytes
NegotiateFlags: 0x212fffff

Authentication Flow

  1. Client calls NetrServerReqChallenge (sends 8 zero bytes)
  2. Server responds with ServerChallenge
  3. Client calls NetrServerAuthenticate3 (ClientCredential = zeros)
  4. On success (~1/256), client sets DC machine password to empty

Event Log Detection

Event IDs

Event Source Description
5827 Netlogon Vulnerable connection denied
5828 Netlogon Vulnerable connection allowed
5829 Netlogon Vulnerable connection (audit mode)
5830 Netlogon Device allowed by GPO exception
5831 Netlogon Device denied

KQL Detection

SecurityEvent
| where EventID in (5827, 5828, 5829)
| project TimeGenerated, Computer, EventData

Remediation

  1. Apply KB patches immediately
  2. Set FullSecureChannelProtection = 1
  3. Monitor Event IDs 5827-5831
  4. Block RPC port 135 from untrusted networks
  5. Enable DC enforcement mode