Conversation

Notices

Embed this notice
Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 18-Sep-2025 03:04:53 JST Kevin Beaumont

Dirk-jan Mollema, who discovered Zerologon (the most impactful on prem Active Directory vulnerability ever), has discovered an Azure Active Directory (EntraID) vulnerability which allowed anybody to take over any tenant - access any Microsoft 365 resource, basically. CVE-2025-55241
https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

In conversation about a year ago from cyberplace.social permalink
- Embed this notice
  Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 18-Sep-2025 03:05:14 JST Kevin Beaumont
  in reply to
  
  My favourite thing about this one is the cross tenant bit generated no logs in the victim's tenant.. so good luck with that. MS assigned a CVE, said no customer action needed, and then didn't tell anybody about the details.
  
  In conversation about a year ago permalink
- Embed this notice
  Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 18-Sep-2025 03:05:31 JST Kevin Beaumont
  in reply to
  
  Prior from Dirk-jan Mollema was ZeroLogon, a fun vuln which allowed anybody to reset a domain controller password.
  https://doublepulsar.com/in-the-wild-exploitation-of-zerologon-detected-over-the-internet-on-honeypot-f61e2700215b
  
  In conversation about a year ago permalink
- Embed this notice
  James Forshaw :donor: (tiraniddo@infosec.exchange)'s status on Thursday, 18-Sep-2025 03:06:32 JST James Forshaw :donor:
  in reply to
  
  @GossiTheDog Errata ID [sic] is just too complex for it's own good. It's like they looked at AD, and went "What if more, and harder to reason about", then bolted on on-prem AD connection for good measure.
  
  In conversation about a year ago permalink
- Embed this notice
  raptor :C_H: (raptor@infosec.exchange)'s status on Thursday, 18-Sep-2025 03:33:12 JST raptor :C_H:
  in reply to
  - James Forshaw :donor:
  @GossiTheDog @tiraniddo Dirk-jan is a friend and a fantastic hacker, but I don’t think he was the original discoverer of ZeroLogon https://dirkjanm.io/a-different-way-of-abusing-zerologon/
  In conversation about a year ago permalink
  Attachments
  1. Domain not in remote thumbnail source whitelist: dirkjanm.io
    
    A different way of abusing Zerologon (CVE-2020-1472)
    
    In August 2020, Microsoft patched CVE-2020-1472 aka Zerologon. This is in my opinion one of the most critical Active Directory vulnerabilities of the past few years, since it allows for instant escalation to Domain Admin without credentials. The most straightforward way to exploit this involves changing the password of a Domain Controller computer account. This is a risky move and could potentially break things in the environment. In this blog we explore a new way to exploit this vulnerability, which though it has a few more prerequisites, is safer to use for security professionals assessing network security. We’ll also dive a bit more into the authentication protocols in Active Directory and how they can be tied in with the Zerologon vulnerability. While this is a different way of exploiting the vulnerability, it does not bypass the mitigations released, so if you have already installed the August 2020 patches, you are also protected from this attack.
- Embed this notice
  Joshua Small (jsmall@infosec.exchange)'s status on Thursday, 18-Sep-2025 08:06:42 JST Joshua Small
  in reply to
  
  @GossiTheDog I like how you talk about this in the past tense as though I don't use it on pentests today.
  
  In conversation about a year ago permalink

Public

Conversation

Notices

Feeds