mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
88 lines
2.1 KiB
Markdown
88 lines
2.1 KiB
Markdown
# API Reference: Zerologon (CVE-2020-1472)
|
|
|
|
## Vulnerability Overview
|
|
- **CVE**: CVE-2020-1472
|
|
- **CVSS**: 10.0 (Critical)
|
|
- **Protocol**: MS-NRPC (Netlogon Remote Protocol)
|
|
- **Port**: 135 (RPC)
|
|
- **Impact**: Domain Admin without credentials
|
|
|
|
## Attack Mechanism
|
|
The Netlogon AES-CFB8 implementation uses a static IV of zero bytes.
|
|
Sending authentication requests with 256 zero bytes succeeds with
|
|
probability 1/256 per attempt.
|
|
|
|
## Detection Tools
|
|
|
|
### Nmap
|
|
```bash
|
|
nmap -p 135,445 --script smb-vuln-cve-2020-1472 <DC_IP>
|
|
```
|
|
|
|
### Impacket zerologon_tester.py
|
|
```bash
|
|
zerologon_tester.py DC01 10.10.10.1
|
|
```
|
|
|
|
### CrackMapExec
|
|
```bash
|
|
crackmapexec smb <DC_IP> -u '' -p '' -M zerologon
|
|
```
|
|
|
|
## Patch Information
|
|
|
|
### Microsoft KBs
|
|
| KB | OS Version |
|
|
|----|-----------|
|
|
| KB4571694 | Windows Server 2016 |
|
|
| KB4571703 | Windows Server 2019 |
|
|
| KB4571723 | Windows Server 2012 R2 |
|
|
| KB4571736 | Windows Server 2012 |
|
|
|
|
### Registry Key for Enforcement
|
|
```
|
|
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
|
|
FullSecureChannelProtection = 1 (DWORD)
|
|
```
|
|
|
|
## MS-NRPC Protocol
|
|
|
|
### NetrServerAuthenticate3
|
|
```
|
|
DCERPC call to \PIPE\netlogon
|
|
Function: NetrServerAuthenticate3
|
|
ClientCredential: 8 zero bytes
|
|
NegotiateFlags: 0x212fffff
|
|
```
|
|
|
|
### Authentication Flow
|
|
1. Client calls `NetrServerReqChallenge` (sends 8 zero bytes)
|
|
2. Server responds with ServerChallenge
|
|
3. Client calls `NetrServerAuthenticate3` (ClientCredential = zeros)
|
|
4. On success (~1/256), client sets DC machine password to empty
|
|
|
|
## Event Log Detection
|
|
|
|
### Event IDs
|
|
| Event | Source | Description |
|
|
|-------|--------|-------------|
|
|
| 5827 | Netlogon | Vulnerable connection denied |
|
|
| 5828 | Netlogon | Vulnerable connection allowed |
|
|
| 5829 | Netlogon | Vulnerable connection (audit mode) |
|
|
| 5830 | Netlogon | Device allowed by GPO exception |
|
|
| 5831 | Netlogon | Device denied |
|
|
|
|
### KQL Detection
|
|
```kql
|
|
SecurityEvent
|
|
| where EventID in (5827, 5828, 5829)
|
|
| project TimeGenerated, Computer, EventData
|
|
```
|
|
|
|
## Remediation
|
|
1. Apply KB patches immediately
|
|
2. Set `FullSecureChannelProtection = 1`
|
|
3. Monitor Event IDs 5827-5831
|
|
4. Block RPC port 135 from untrusted networks
|
|
5. Enable DC enforcement mode
|