Zerologon (CVE-2020-1472)

Netlogon is how Windows machines authenticate to a domain controller. Its handshake used AES in an unusual mode (CFB8) with a fixed starting value. Tom Tervoort of Secura found that if an attacker sends a challenge made of all zeros, about one time in 256 the expected answer is also all zeros. So an attacker with no password simply keeps trying, and after a few hundred quick attempts the domain controller accepts them.

Once accepted, the attacker uses Netlogon itself to set the domain controller's own machine password to empty, then logs in as the domain controller and pulls every password hash in the domain. All it needs is network access to a domain controller. Microsoft patched it in August 2020 and enforced the fix by default in February 2021, and CISA issued an emergency directive, an unusual step, ordering US federal agencies to patch.

Criminals adopted it quickly. In one intrusion documented by The DFIR Report, Ryuk ransomware operators went from a phishing email to Zerologon on the domain controller in under two hours, and had ransomware across the domain in about five. Espionage groups used it too. Domain controllers are the keys to the kingdom: patch them first and alert on unexpected machine-account password changes.