ZeroLogon Exploit - Abusing CVE-2020-1472

[@TCMSecurityAcademy]

I hope you enjoyed this video! If so, please consider dropping a like and subscribing.

[@kaleababdurahman5318]

my favorite mentor on youtube.

[@null_1065]

I really aspire to be like you Cyber Mentor. I hope to have a family and a good head on my shoulders like you, God Bless you sir!

[@The1996Rockers]

It means that we can takeover any domain controller till now which haven't been patched for this exploit? Eg: can we takeover the forest machine from HTB from this exploit?

[@andyli]

Yes, just tested it. It works

[@shreyashhire7527]

Thankyou for all this man 🔥 ur content is super helpful ♥️🙌

[@socrayhte]

Please how were you able to run impacket in the virtual environment @4:23

[@parampreetrai7093]

I'm surprised that u still had this Hydra-DC virtual image that u setuped on penetration testing course. 😁 Great video 👍👍👍

[@igorpasternak8127]

Thx a lot for the newest vulnerability review!!!

[@abdullahanas7679]

where i can get an AD unpathes?

[@or_test]

do not perform on production. this WILL destroy your system.

[@neonode2575]

First video I'm seeing, didn't see the whole video, but liked anyway :)

[@cybercashz]

I bought your hacker bundle from ur new tcm academy really looking forward to learn together 😁

[@randomapperatus3773]

Going through your PEH right now. Christian at Intrinium told me I should buy in case you wanna give him a kick back 🤣🤣

[@nottahgiyn7866]

Awesome now I want to figure out how to counter this

[@hackingsecurity6180]

Dope man, this is so litt

[@pinikorn9216]

So what's the solution for this?

[@lee_carter]

Apply the MS patch from the Microsoft website (support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc#EnforcementMode ) and if this is a Samba DC applying server channel config detailed on Samba website (www.samba.org/samba/security/CVE-2020-1472.html )

[@anissehounaoui2139]

If you want to detect if you are vilnerable to this exploit, you can download a tool made by cynet you will find it in the end of this article : www.anissecurity.com/news/zerologon-vulnerability/

[@ollyalmon6460]

The fact this vulnerability is very simple but also very dangerous to people with bad intentions... Note PATCH this on your stuff ASAP.

[@dhanushholla9221]

Could you please explain what marvel was? And during secret dump you added -just-dc what that stands for?...BY THE BIG FAN AND LOVE FROM INDIA💯🤩❤️ HAPPY TO SEE YOUR VIDEOS . GURU 🙇

[@Darth0010]

amazing video! I know it's an old video but I am trying to create an assignment where students can try to use this exploit; its for a penetration testing class. Would you know any way I can get my hands on a Windows Server 2019 ISO that's unpatched?

[@gr4vedigg3r]

you the best keep it up!

[@justsahilgamer9742]

i have one question that how do we identify that this vuln is there in the pc ?

[@febday5944]

Thank bro That good!!! and easy to learning for beginner.

[@stanev123]

How can I find the domain name of the target?

[@dhanushholla9221]

For what impacket is used? And how to use hashes inview of getting access?

[@drakesh6379]

Is attacker should be sitting in the network, to exploit this attack?

[@samudrasarma6555]

Nope

[@lee_carter]

Yes unless you are silly enough to have your netlogon hanging on a public network.

[@cocplayers4459]

How to find find vulnerability???

[@yashodhanpagar]

Love from INDIA ❤️ I AM YOU STUDENT AT UDEMY PRACTICAL ETHICAL HACKING ❤️

[@911outrun]

I feel like I should find a scanner to detect this if possible (too dumb to make one in enough time). Would help a bit at work since I just spent how long making sure my systems were patched

[@samudrasarma6555]

I already automated this if you need the python script ping me.

[@mohamedhamed1286]

@@samudrasarma6555 can you send me please ? [e-mail]

[@dadquestionmark]

There is a scanner script on GitHub, don't let random people on youtube send you one lol

[@911outrun]

@@dadquestionmark Yeah I managed to find the one from Secura and as far as I can tell it looks clean but will run it against a test dc at home first and see what it does.

[@dadquestionmark]

@@911outrun Yep that's the one. Alternatively you could use wmi, for example, to check remote systems for the patch.

[@dhanushholla9221]

I'm very new to this field thats why I'm asking so much of doubts..don't mind bro 😁😅

[@manamnice]

Missed the 2018 kalilinux

[@chiragagrawal7856]

Thank you for the share

[@demiscuzz6427]

How do you run in virtual env in Kali ?

[@Luezzy]

there is any mitigation for this exploit?

[@UlfKlose]

There's a patch from Microsoft.

[@CanCaner163]

does it work remote with external ips ?

[@dcdiagfix]

You should do a version using the print spooler vuln it doesn’t break the computer password!

[@anissehounaoui2139]

More details please?

[@Bob-hk9mx]

Is this exploit require target in same network ?

[@Lim3tree]

Is this tool allowed in OSCP exam?

[@kevinlim4452]

which hash do i use if i want to run reinstall_original_pw.py ?

[@sayurionella6256]

I did this exploitation. but it not correctly run, please help me

[@SensitiveEvent]

I'm currently in the middle of three engagements. I ran this on two of them, I can no longer resolve hosts and authentication is acting weird. Is there a restore feature like script.py -r? Debating on trying it on the last engagement and just calling it a night. Thanks in advanced.

[@gr4vedigg3r]

hey I don't think you should have run it on a engagement. you should try and restore it immediately because it can leave it vulnerable if it was not patched

[@henrythegod6756]

Per the github instructions: "And that should show you the original NT hash of the machine account. You can then re-install that original machine account hash to the domain by python3 reinstall_original_pw[dot]py DC_NETBIOS_NAME DC_IP_ADDR ORIG_NT_HASH Reinstalling the original hash is necessary for the DC to continue to operate normally." github[dot]com/risksense/zerologon

[@dadquestionmark]

wow

[@SensitiveEvent]

@@gr4vedigg3r Whatever they should have patched their servers. One of the companies called me this morning raging that their network wasn't working, it's not my fault. Two directors and the CEO got on on a conference call and agreed with me that an attacker could have done the same thing. meh, they can restore from backups. I'll try again later tonight.

[@gr4vedigg3r]

@@SensitiveEvent yea bt I wouldn't recommend running scripts tht hurt the clients network if I would want to run tht script I'd call them up and tell them to make a backup and have someone ready to fix it up if it goes down ;)

[@MrTJadam]

is this safe to use on bug bounty targets? Or will set_empty_pw.py screw up their DC? Thanks

[@nero2k619]

You won't find any public or private programs exposing their domain controller to public.

[@neetech3716]

Great 🔥

[@srlsec]

TCM

[@antoniodesilva]

Can you explain how you ran the virtual environment? Thanks!

[@Em-ef4vh]

Here's some documentation on that: novicenolonger.com/safe-python-playing-with-virtualenv/

[@antoniodesilva]

@@Em-ef4vh Thanks, will try it out!

[@WoLFyy2009]

This exploit only windows server 2012?

[@Aarun3096]

Hi sir...back with zerologon vulnerability....it was just short & wealthy more to get....suberub

[@KUMAR-mm4sw]

Sir how to insert a name in any website at particular place by hacking ? Which tools, method etc. is used for that?

[@dadquestionmark]

Hack everything with Inspect Element

[@MrPeter-jt3nd]

it doesn't work 😵😵

[@null.ru.1337]

Cuz the domain controller was patched.

[@AntiWanted]

Nice

[@MH-tw1qi]

Your KZbin fans are waiting for new content

[@TCMSecurityAcademy]

Is this not new content?

[@parampreetrai7093]

@@TCMSecurityAcademy👌😂

[@shrirangkahale]

Heyy...

[@nwodomitchel8921]

Superb education and awareness tips. Please throw more light on how you installed impacket, because the secretsdump.py command is not found on my kali 2020.3 I was only able to install impacket 0.9.21, please help out on how you installed 0.9.22

[@umersaeed6032]

did you manage to get impacket 0.9.22? if so how

[@justsahilgamer9742]

tryhackme also created a room for this specific cve

[@MicahHidlebaugh]

first!

[@fenilshah9221]

First

[@facttrendz1314]

Sir how to download old gnome environment on Kali Linux 2020