> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory/ad-common-vulnerablities.md).

# AD Common Vulnerablities

### &#x20;Abusing ZeroLogon <a href="#lecture_heading" id="lecture_heading"></a>

We set up the domain controller password as null

{% embed url="<https://www.trendmicro.com/en_us/what-is/zerologon.html>" %}

{% embed url="<https://github.com/dirkjanm/CVE-2020-1472>" %}
exploit
{% endembed %}

{% embed url="<https://github.com/SecuraBV/CVE-2020-1472>" %}
SecuraBV ZeroLogon Checker
{% endembed %}

<figure><img src="/files/RmT7FglFkshwFjxrxAry" alt=""><figcaption><p>scanning</p></figcaption></figure>

<figure><img src="/files/ywhI1X9MAUFscgN2NzSn" alt=""><figcaption><p>Attacking</p></figcaption></figure>

<figure><img src="/files/3JdtMvyvGiZtft0oXEkH" alt=""><figcaption><p>checking if attack is succesful</p></figcaption></figure>

<figure><img src="/files/UvRYtgGTBtAEOmAeldEZ" alt=""><figcaption><p>Restore Password</p></figcaption></figure>

### PrintNightmare (CVE-2021-1675) <a href="#lecture_heading" id="lecture_heading"></a>

{% embed url="<https://github.com/cube0x0/CVE-2021-1675>" %}
cube0x0 RCE
{% endembed %}

{% embed url="<https://github.com/calebstewart/CVE-2021-1675>" %}
calebstewart LPE
{% endembed %}

<figure><img src="/files/295j3he2kKYLcdY47Sft" alt=""><figcaption><p>scanning for if vulnerable</p></figcaption></figure>

Make a malicious dll

<figure><img src="/files/9uKwJJrR4wV2wYdC6GEk" alt=""><figcaption></figcaption></figure>

share the directory

<figure><img src="/files/SegBWKP2lCe5jOhW7YD8" alt=""><figcaption></figcaption></figure>

Exploitation

<figure><img src="/files/rXx8paYPs1Y5OKOsAfsA" alt=""><figcaption></figcaption></figure>