Zerologon (CVE-2020-1472).

Zerologon (CVE-2020-1472, CVSS 10.0) is a critical elevation-of-privilege flaw in the Microsoft Netlogon Remote Protocol (MS-NRPC). Microsoft patched it in the August 2020 Patch Tuesday, and Secura's Tom Tervoort published the full technical analysis on 11 September 2020. The root cause is the insecure use of AES-CFB8: the ComputeNetlogonCredential function fixes the initialization vector to all zeros instead of randomising it. With an all-zero IV and all-zero plaintext, the ciphertext is all zeros roughly 1 in 256 times — so an unauthenticated attacker on the network can impersonate any domain-joined machine, including a Domain Controller, by simply retrying.

After bypassing authentication, the attacker uses a Netlogon call to reset the DC's machine-account password to an empty value, then performs DCSync to dump every credential hash (including krbtgt) and obtain Domain Admin within minutes. Note that resetting the DC password desynchronises it from Active Directory, which can break the DC if not restored. CISA issued Emergency Directive 20-04, and Microsoft enforced secure RPC by default in the February 2021 update. Ransomware operators (including Ryuk) and APTs weaponised it rapidly. Defences: apply both the August 2020 and February 2021 updates, enable DC enforcement mode, and monitor Event IDs 5827/5829 for vulnerable Netlogon connections.

flowchart TD
  A[Unauthenticated attacker on LAN] -->|"Forged Netlogon auth, all-zero IV"| B[Domain Controller]
  B --> C{"Ciphertext = 0?<br/>(~1 in 256)"}
  C -->|No| A
  C -->|Yes| D[Authentication bypassed<br/>impersonate DC machine account]
  D --> E[Reset DC machine password<br/>to empty value]
  E --> F[DCSync: dump all hashes<br/>incl. krbtgt → Domain Admin]