Windows Active Directory Exploit: ‘Zerologon’ Lets Anyone on Local Network Obtain Domain-Controller Password
September 15th, 2020
Via: Ars Technica:
Researchers have developed and published a proof-of-concept exploit for a recently patched Windows vulnerability that can allow access to an organization’s crown jewels—the Active Directory domain controllers that act as an all-powerful gatekeeper for all machines connected to a network.
…
“It basically allows any attacker on the local network (such as a malicious insider or someone who simply plugged in a device to an on-premise network port) to completely compromise the Windows domain. The attack is completely unauthenticated: the attacker does not need any user credentials.”
The Secura researchers who discovered the vulnerability and reported it to Microsoft said they developed an exploit that works reliably, but given the risk, they aren’t releasing it until they’re confident Microsoft’s patch has been widely installed on vulnerable servers.
