Onelogon Attack Bypasses Microsoft's Zerologon Patch

Researchers at Ruhr University have found that Microsoft's patch for the Zerologon vulnerability is incomplete and can be bypassed. The researchers, Alexander Neff, Tobias Holl, and Kevin Borgolte, dubbed their new attack Onelogon, which allows attackers to fully compromise an Active Directory management domain.

Onelogon exploits a 24-bit brute force attack that needs a compromised, low-privilege computer account to reset a server-side challenge cache. It can gain access in about 32 minutes on average, while a second meet-in-the-middle attack can get through in 37 minutes on average without prior account access.

Microsoft won't fix the issue, as its best practice advice is to always use secure Remote Procedure Calls (RPCs), which stop the Zerologon and Onelogon vulnerabilities. However, not every organisation can run secure RPC, and nearly a quarter of 44 AD enterprise environments still have an active group policy allowing vulnerable Netlogon secure channel connections.

The researchers pointed out that Microsoft's Netlogon protocol is part of Active Directory and proves a computer's identity in a network domain by scrambling a code using a secret key. However, the protocol was written to start from a fixed, predictable point, hardcoded to all zeroes, which makes it vulnerable to attacks.

Microsoft's patch for Zerologon only checks if the first five bytes of a challenge are all identical and rejects these. However, this does not catch other structured ones that can still produce predictable ciphertext, making the patch incomplete and bypassable.