Onelogon Taking over Active Directory Accounts via Netlogon

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/rub-softsec/onelogon
• Blog Title: Onelogon: Taking over Active Directory Accounts via Netlogon
• Suggested Section: Windows Hardening / Active Directory Methodology / Netlogon or Zerologon-related account takeover via VulnerableChannelAllowList

🎯 Content Summary

Onelogon is a GitHub repository by rub-softsec containing code, data, scanner logic, and proof-of-concept exploit scripts for the WOOT'26 paper Onelogon: Taking over Active Directory Accounts via Netlogon. The repository focuses on an Active Directory account-takeover weakness in Microsoft’s 2020 cryptographic hardening for Zerologon, commonly associated with CVE-2020-1472. The attack does not rely on the original unpatched Zerologon con...

🔧 Technical Details

Abusing Netlogon legacy allow-lists after Zerologon hardening: Some Domain Controllers may be configured to allow vulnerable Netlogon secure-channel behavior for legacy systems that do not support Netlogon signing and sealing. The configuration is controlled by the GPO Domain Controller: Allow vulnerable Netlogon secure channel connections and the registry value HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\VulnerableChannelAllowList. The value is an SDDL security descriptor. If an account is included in the DACL, that account can be targeted even when the Domain Controller is patched against the original Zerologon issue. A broad descriptor such as O:BAG:BAD:(A;;RC;;;WD) adds WD / Everyone and makes all accounts vulnerable in the demonstrated test setup.

Finding exploitable accounts through GPO/SYSVOL and registry inspection: To identify targets, inspect both the live registry and SY...

🤖 Agent Actions

Done.

Updated:

• src/windows-hardening/active-directory-methodology/README.md

Added:

• A new Onelogon / Netlogon vulnerable-channel allow-list abuse subsection
• Coverage of:
  • VulnerableChannelAllowList
  • GPO/registry location
  • SDDL-based target identification
  • SYSVOL + registry triage
  • exploit workflow and PoC commands
  • high-impact DC$ takeover angle
  • Netlogon event IDs 5827/5828/5829/5830/5831
• References:
  • Onelogon GitHub repo
  • Microsoft Netlogon hardening guidance

Validation:

• Diff reviewed successfully
• mdbook build could not be run because mdbook is not installed in this environment (mdbook: command not found)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/rub-softsec/onelogon

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening / Active Directory Methodology / Netlogon or Zerologon-related account takeover via VulnerableChannelAllowList".

Repository Maintenance:

• MD Files Formatting: 977 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0