Onelogon: Taking over Active Directory Accounts via Netlogon
summary
Onelogon demonstrates practical account takeover of Active Directory by abusing Netlogon’s incorrect AES-CFB8 use: two attack variants let an attacker reset a targeted computer or Domain Controller password and perform DC sync, with full compromise in ~30 minutes (fastest ~40 minutes, naive brute force ~30 days). The exploit uses the Netlogon 100,000-challenge list and a 17-bit seven‑bit split brute force to speed up attempts ~1,600×, bypasses Microsoft’s patches, and finds 6 of 217 and 10 of 44 deployments with vulnerable GPOs; mitigation requires fixing AES-CFB8 and tightening authenticators.
AI-written summary · about
chapters (8)
- 0:00Active Directory & Netlogon intro
- 1:13Netlogon auth mechanisms
- 3:39Zerologon and AES CFB8
- 5:48Microsoft patches limits
- 7:55Bypassing crypto patch
- 9:21Attack timings feasibility
- 10:46Mitigation strategies
- 12:10Related research
related talks
50mHybrid Active Directory Attacks: Anatomy and Defenses
40mTop Active Directory Attacks: Understand, then Prevent and Detect
37mThreat Hunting in Active Directory Environment
47mFinding a Needle in an Encrypted Haystack
50mBeyond the Mcse: Active Directory for the Security Professional
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
58mHacking in 2016 - How is our systems broken?
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field