{"id":11555,"date":"2020-10-02T00:28:15","date_gmt":"2020-10-02T00:28:15","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=11555"},"modified":"2026-04-17T18:07:47","modified_gmt":"2026-04-17T18:07:47","slug":"netlogon-privilege-escalation-vulnerability-cve-2020-1472-handling-guide","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/netlogon-privilege-escalation-vulnerability-cve-2020-1472-handling-guide\/","title":{"rendered":"Netlogon Privilege Escalation Vulnerability (CVE-2020-1472) Handling Guide"},"content":{"rendered":"\n

1.  Vulnerability Description<\/h2>\n\n\n\n

Recently, NSFOCUS detected that the foreign security company Secura disclosed detailed information and validation scripts about the Netlogon privilege escalation vulnerability (CVE-2020-1472), which increases vulnerability risks abruptly. Exploitation of this vulnerability requires a computer on the same local area network (LAN) as the target. When using the Netlogon Remote Protocol (MS-NRPC) to establish a secure channel connection to a domain controller, an unauthenticated attacker could exploit the vulnerability to obtain domain administrator access. The vulnerability was disclosed by Microsoft in its August 2020 security updates. With a CVSS base score of 10, it has an extensive impact. At present, EXP has been made public on the Internet. Affected users are advised to take preventive measures as soon as possible.<\/p>\n\n\n\n\n\n\n\n

Netlogon is a service used to register all SRV resource records for domain controllers in Windows. It authenticates users and machines on intra-domain networks and replicates databases for domain control backup. It is also used to maintain the relationships between domain members and domains, between domains and domain control, and between domain DC and cross-domain DC.<\/p>\n\n\n\n

NSFOCUS reproduced the vulnerability shortly after it was reported:<\/p>\n\n\n\n

\"Red<\/figure><\/div>\n\n\n\n

Reference link:<\/p>\n\n\n\n

\nhttps:\/\/portal.msrc.microsoft.com\/en-US\/security-guidance\/advisory\/CVE-2020-1472\n<\/div><\/figure>\n\n\n\n

2. Scope of Impact<\/h2>\n\n\n\n

Affected versions<\/strong><\/h3>\n\n\n\n