This paper aims to explain the detailed working of Zerologon vulnerability. Zerologon vulnerability arise due to insecure implementation of AES-128 Counter Feedback Mode of Operation in Microsoft Netlogon Remote Procedure Calls (MS-NRPC) protocol.
- Understanding what is Netlogon protocol and how it works.
- Different vulnerabilities in this protocol and how to check for them.
- Prerequisites to setup the lab to perform the exploit.
- Running the testers and crafting the exploit.
- Mitigatiuons and Preventions to prevent such attacks.