Hi Guys,
This is not an issue, more a question.
I used your script to test updated Domain Controller and it works well. I also test it on unpatched DC.
On both case I have triggered 2 logs Event 5805 for each script launched.
Is it what is expected ?
Can i use event Log 5805 + my DC name appears in the message ("the from Computer") of the log to conclude to a Zerologon attack ?
Moreover i found a small difference between a patched and not patched:
In unpatched case the 2 event are the same.
In patched case in one of the event i got the attack computer in the message of the event (and not the DC)
My test with a patched result is:
2000 requests from the script resulting on 2000 packets TCP/port 135 + 2000 packets TCP/65xxx on Firewall (the RPC calls)
On the DC event log I can find 2 5805 events:
2020-11-10T09:30:12.000Z MyDC1234.ADS.LOCAL AttkCp888 5805 The session setup from the computer AttkCp888
failed to authenticate. The following error occurred: \r\nAccess is denied.
2020-11-10T09:30:12.000Z MyDC1234.ADS.LOCAL mydc1234 5805 The session setup from the computer mydc1234 failed to authenticate. The following error occurred: \r\nAccess is denied.
Now when I take a non patched DC:
Success! DC can be fully compromised by a Zerologon attack.
2020-11-10T09:42:23.000Z MyDC1234.ADS.LOCAL mydc1234 5805 The session setup from the computer mydc1234 failed to authenticate. The following error occurred: \r\nAccess is denied.
2020-11-10T09:42:23.000Z MyDC1234.ADS.LOCAL mydc1234 5805 The session setup from the computer mydc1234 failed to authenticate. The following error occurred: \r\nAccess is denied.
Hi Guys, This is not an issue, more a question. I used your script to test updated Domain Controller and it works well. I also test it on unpatched DC.
On both case I have triggered 2 logs Event 5805 for each script launched. Is it what is expected ?
Can i use event Log 5805 + my DC name appears in the message ("the from Computer") of the log to conclude to a Zerologon attack ?
Moreover i found a small difference between a patched and not patched:
My test with a patched result is: 2000 requests from the script resulting on 2000 packets TCP/port 135 + 2000 packets TCP/65xxx on Firewall (the RPC calls) On the DC event log I can find 2 5805 events:
failed to authenticate. The following error occurred: \r\nAccess is denied.
Now when I take a non patched DC:
Success! DC can be fully compromised by a Zerologon attack.