Onelogon: Taking over Active Directory Accounts via Netlogon🔑

We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵
Unlike Zerologon, the exploit requires a non-default GPO to be configured. Specifically, all accounts for which RPC signing&sealing is disabled can be compromised with this exploit. The GPO was added with the Zerologon patch to ensure backwards compatibility for legacy systems🧵