--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: CERT-EU, The Cybersecurity Service for the European Union institutions, bodies, offices and agencies title: 'Zerologon Critical Vulnerability Affecting Windows Domain Controllers' version: '1.1' number: '2020-046' date: 'September 25, 2020' --- _History:_ * _15/09/2020 --- v1.0 -- Initial publication_ * _25/09/2020 --- v1.1 -- Updated with details on attacks, SAMBA, and new detection methods_ # Summary On 11th of August 2020, Microsoft released a critical security advisory affecting all supported versions of Windows Server [1]. The vulnerability is described as *Netlogon Elevation of Privilege* and got assigned CVE-2020-1472 [2]. On 11th of September 2020, Secura released a white paper [3] and testing tool [4] for the vulnerability. The paper^[*Zerologon: Unauthenticated domain controller compromise by subverting Netlogon cryptography (CVE-2020-1472)*] describes how an attacker with a foothold on a victim network could leverage this vulnerability to compromise an unpatched Domain Controller. The attacker can obtain domain admin privileges by taking advantage of flaws in a cryptographic authentication protocol. Starting on the 14th of September 2020, several _security researchers_ modified the initial testing tool created by Secura to provide full proof of concept of the vulnerability, allowing any attacker with a foothold on a victim network to easily elevate its privileges to domain admin. On 23rd of September 2020, SAMBA also released security patches addressing the vulnerability, explaining that SAMBA server is vulnerable if used as a Domain Controller [10]. On 24th of September 2020, Microsoft Security Intelligence warned that ongoing attacks were being observed abusing Zerologon vulnerability [6]. # Technical Details The vulnerability was assigned *CVE-2020-1472* [2] with a CVSS score of 10. The core of the vulnerability is due to an insecure use of AES-CFB8: When using EAS, the `ComputeNetlogonCredential` function makes use of CFB8 (8-bit cipher feedback) mode for block cipher operation, but wrongly uses a fixed value as an initialisation vector (16 zero bytes). Because of that, for 1 in 256 keys, applying AES-CFB8 encryption to an all-zero plaintext will result in all-zero ciphertext. Several steps are then needed to exploit this weakness: * Step 1: Spoofing client credentials by using brute-force authentication attack (average attempts: 256) with a challenge value of 8 zeroes. * Step 2: Disabling signing and sealing by unsetting a flag in the `NetrServerAuthenticate3` call, leading to requesting a session without encryption. * Step 3: Spoofing the first call after authentication by setting timestamp value to 0 (January 1st, 1970). * Step 4: Changing a computer’s AD password by using the `NetrServerPasswordSet2` call with a plaintext value of 516 zeroes, which lead to the computer password to be set as empty. * Step 5: From password change to domain admin by performing the attack on the Domain Controller itself and running a DCsynch attack with the newly emptied password. ## Detection Since the initial release of information about this vulnerability, several security researchers provided more information on detection of Zerologon attacks [7, 8]. Also Microsoft provided a way to enforce usage of secure RPC with Netlogon secure channel between member computers and Active Directory (AD) Domain Controllers (DC) [9]. There is three specific steps of the attack which provide possibilities for defenders to detect exploitation of the vulnerability: ### Initial Spoofing of Client Credentials When initiating the attack, it is necessary to perform several authentication attempts before getting the expected cyphertext value (all-zero) as described in the tester script [4]: # Keep authenticating until successful. Expected average number of attempts needed: 256. It means that several events may be triggered during this step of the attack so some monitoring may be used to detect attempts to exploit the vulnerability: * Monitor network traffic for high number of `NetrServerReqChallenge` and/or `NetrServerAuthenticate3` RPC operations * Monitor Windows events for high number of failed machine account netlogon authentication on domain controller (EventID=5805) ### DCSync The last step of the attack consist of performing a DCSync attack on the targeted Domain Controller (In the paper, researcher use *Impacket’s* `secretsdump` script). It means that usual way to detect DCSync attack can be used: * Monitor network traffic for `DRSUAPI` RPC requests (operation `DsGetNCChanges`) and compare the source host against a list of known domain controllers * Monitor Windows events for EventID 4662 with GUID = `{1131f6ad-9c07-11d1-f79f-00c04fc2dcd2}` (`DS-Replication-Get-Changes-All` Control access right) [5] ### Modification of machine credentials When the attack is successful, computer's AD password will be modified, triggering one or several detection possibilities: * Monitor Windows events for Change of computer account (EventID=4742) by an anonymous logon * Monitor Windows events for succesful login (EventID=4624) followed by an password account reset (EventID=4624) # Products Affected This vulnerability affects the following Microsoft Server versions: * Windows Server 2008 R2 for x64-based Systems Service Pack 1 * Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) * Windows Server 2012 * Windows Server 2012 (Server Core installation) * Windows Server 2012 R2 * Windows Server 2012 R2 (Server Core installation) * Windows Server 2016 * Windows Server 2016 (Server Core installation) * Windows Server 2019 * Windows Server 2019 (Server Core installation) * Windows Server, version 1903 (Server Core installation) * Windows Server, version 1909 (Server Core installation) * Windows Server, version 2004 (Server Core installation) This vulnerability also affects SAMBA server if used as Domain Controller: * Samba 4.0 and later # Recommendations CERT-EU recommends updating following Microsoft guidance as soon as possible [1]. If some 3rd party devices needs to communicate with Domain controllers, it is also recommended to enforce usage of secure RPC with Netlogon secure channel and create exceptions for devices not able to communicate securely, as described by Microsoft [9]. Regarding SAMBA server, if used as domain controller, it is also highly recommended to patch as soon as possible [10]. # References [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]