Windows Netlogon Remote Code Execution Vulnerability

The repository contains a README and one standalone Python 3 exploit script, longlogon_exploit.py; it has no external dependencies or exploit-framework integration. The script builds BER/TLV-encoded CLDAP LDAP SearchRequest packets that request the Netlogon attribute and include DnsDomain, User, and NtVer equality filters. It sends these packets via IPv4 UDP port 389. Based on the repository's claims, NtVer 0x02 selects a vulnerable legacy Netlogon response-building path, while 0x06/0x16 select a bounded path. The exploit first sends a benign User="x" probe, calculates a projected full response size using the response length, and normally refuses to fire below its 536-byte definite-crash threshold unless --force is used. It then sends a User field of 130 characters, waits for a reply or timeout, and, after a silent packet, waits and re-probes to distinguish probable LSASS crash/reboot from a dropped UDP packet. Its implemented outcome is denial of service/reboot rather than remote code execution; no shellcode, command execution, persistence, or data-exfiltration payload is present.

The repository contains a README and one standalone Python 3 exploit, longlogon_exploit.py; it uses only the standard library and is not part of an exploit framework. The script builds BER/LDAP CLDAP search requests with DnsDomain, User, and NtVer Netlogon filter fields, probes the specified domain controller first with a one-character User value, estimates whether the server-side response will exceed the 536-byte crash threshold, and then sends a 130-character User field with NtVer 0x02. According to the included documentation and code, this targets CVE-2026-41089 in the legacy Netlogon BuildSamLogonResponse path on unpatched Windows Server 2025 domain controllers. The operational capability is unauthenticated network DoS against UDP/389: an overflow is intended to corrupt the /GS stack cookie, terminate lsass.exe with 0xc0000409, and reboot the DC. Options support dry-run probing, repeated shots, delayed confirmation, and forcing attempts in borderline size conditions. The code does not provide a remote shell, command execution, persistence, or data-exfiltration capability.

Small standalone Python exploit repository for CVE-2026-41089. The repo contains one real code file (poc.py), a README with vulnerability and usage details, plus license and gitignore. The exploit is not part of a larger framework. The main capability is crafting BER-encoded LDAP SearchRequest packets for CLDAP over UDP/389 and using them as DC locator pings against a Windows Domain Controller. The script first sends a normal probe with a short username to confirm the target responds, then sends a second packet where the LDAP filter User field is oversized (default 130 characters) to exercise the vulnerable Netlogon path described as I_NetLogonLdapLookupEx -> NlGetLocalPingResponse -> BuildSamLogonResponse -> NetpLogonPutUnicodeString. Finally, it waits briefly and sends another normal ping to determine whether LSASS likely crashed. Operationally, this is a pre-auth network exploit/DoS PoC targeting vulnerable Windows Server domain controllers. It does not include shellcode, post-exploitation, persistence, or a customizable RCE payload. The demonstrated outcome is denial of service via LSASS crash and likely reboot, while the README notes RCE as theoretically possible but not implemented. The code appears genuine and purpose-built rather than a detector-only script, because it actively sends the malformed packet intended to trigger the vulnerability. Fingerprintable targets/endpoints are minimal and mostly protocol-level: UDP port 389 on the supplied target IP, plus LDAP filter attributes DnsDomain, User, and NtVer embedded in the crafted request. The script accepts a target IP and domain name from the command line and uses no hardcoded victim IPs or C2 infrastructure. The README also includes several external reference URLs, but these are documentation links rather than exploit infrastructure.

The repository is minimal and contains one Python proof-of-concept exploit script plus a README. The main file, CVE-2026-41089.py, is a standalone Python 3 network exploit that manually constructs BER-encoded LDAP/CLDAP packets and sends them via UDP to port 389 on a supplied target Domain Controller. Its core capability is to build a CLDAP SearchRequest containing DnsDomain, User, and NtVer fields, with the User field intentionally oversized (default 300 ASCII characters). The script’s comments and logic indicate the overflow occurs when Netlogon converts/copies the username into a roughly 528-byte UTF-16 stack buffer, making this primarily a denial-of-service PoC that may crash LSASS and potentially reboot the Domain Controller. The script does not include shellcode, RCE staging, authentication bypass logic, persistence, or any post-exploitation functionality. Operationally, the script accepts target IP, domain name, username length, NtVer, and timeout parameters; prints size calculations for the username in UTF-8 and UTF-16-LE; sends the crafted packet; and interprets a timeout as a possible crash condition. This makes it a direct exploit PoC rather than a detection-only script. Maturity is best classified as POC because it demonstrates the triggering condition but does not implement a weaponized payload. The README appears partially inconsistent with the actual repository contents. It describes a Windows-oriented analysis tool using PowerShell, a batch launcher (run_analysis.bat), and a config.json file, none of which are present. It also claims the tool performs non-destructive checks, whereas the Python code explicitly attempts to trigger a stack buffer overflow and warns that LSASS may crash and the Domain Controller may reboot. Therefore, the README should not be treated as an accurate description of the exploit behavior; the Python script is the authoritative artifact.

This repository is a small standalone Python proof-of-concept centered on a single executable script, CVE-2026-41089.py, plus a README with marketing-style vulnerability claims and usage guidance. The Python file is the real functional component: it builds a BER-encoded CLDAP/LDAP SearchRequest packet and sends it via UDP to port 389 on a user-supplied target Domain Controller. The crafted request includes Netlogon-related fields DnsDomain, User, and NtVer, with User populated by an oversized attacker-controlled string (default 300 'A' characters). The script explicitly states that 264+ UTF-16 characters should overflow an approximately 528-byte stack buffer in netlogon!NetpLogonPutUnicodeString, and it prints size calculations to help the operator choose a length likely to exceed that threshold. Operationally, the exploit is unauthenticated and network-based. It does not contain shellcode, ROP, post-exploitation logic, or any mechanism to achieve reliable code execution. Instead, it is a crash-oriented trigger PoC: after sending the packet, it waits for a UDP response. If a response is received, it reports that the target may be patched or the username length insufficient; if no response arrives before timeout, it suggests LSASS may have crashed and warns the Domain Controller may reboot. That makes the demonstrated capability denial of service against LSASS/Domain Controller availability, with only speculative RCE potential described in comments and README. Repository structure is minimal and straightforward: one Python entry point using argparse, socket, struct, and colorama; helper functions for BER length/integer/string/sequence encoding; a CLDAP packet builder; and a main routine that parses target/domain/length/NtVer/timeout arguments and transmits the packet. No framework affiliation is present. The README amplifies the impact claims and includes example invocations, but some README details conflict with the code (for example, example lengths such as 130 would not exceed the script's own documented overflow threshold). Overall, this is a standalone operational PoC for sending a malformed CLDAP Netlogon probe intended to crash vulnerable Windows Domain Controllers, not a full weaponized RCE exploit.

This repository contains a Python proof-of-concept for CVE-2026-41089, described as a Windows Netlogon CLDAP stack buffer overflow affecting unpatched Windows Domain Controllers. The main exploit logic is in poc.py, which manually constructs BER/DER-encoded LDAP SearchRequest packets for CLDAP over UDP/389. Its workflow is straightforward: perform an initial connectivity check with a benign username, send a second CLDAP ping with an oversized User attribute intended to trigger the vulnerable Netlogon response path, wait briefly, then perform a final liveness check to determine whether LSASS likely crashed. The stated outcome is denial of service via LSASS crash and DC reboot; the code does not attempt RCE or deliver shellcode. Repository structure is small and centered on poc.py. Supporting files include README.md with vulnerability background, usage examples, affected versions, detection, and mitigation guidance; CI metadata; and standard project files. However, setup.py is unrelated to the PoC’s documented purpose and is highly suspicious: it searches for .dat fragments, reconstructs or treats them as a ZIP archive, extracts contents into src/data/cache/temp/system, locates an .exe, and launches it via os.startfile, with a PowerShell Expand-Archive fallback. This behavior is inconsistent with a benign exploit PoC and resembles a dropper/loader pattern. The bundled cache-like files under src/core/cache/... appear to be placeholder or decoy artifacts and do not contribute to the CLDAP exploit logic. Overall, the repository appears to contain a real network DoS exploit PoC in poc.py targeting Microsoft Windows Server Domain Controllers via unauthenticated UDP/389 CLDAP requests, but it also includes suspicious auxiliary code in setup.py that should not be trusted or executed.

Repository contains a single substantive exploit script, CVE-2026-41089-exp.py, plus a README, license, and .gitignore. The Python script is a standalone network exploit targeting a claimed pre-auth remote code execution vulnerability in Windows Netlogon CLDAP on UDP/389. Based on the visible code and README, the exploit builds a malicious packet with an oversized username field to trigger a stack-based overflow in Netlogon processing, then appends a ROP chain and dynamically generated shellcode. The exploit’s main capabilities are: (1) constructing and sending a crafted UDP CLDAP/Netlogon packet to a remote target IP; (2) generating a ROP chain by locating gadgets such as pop rcx/rdx/r8/r9 in netlogon.dll and resolving VirtualProtect from kernel32.dll; (3) caching gadget search results in .rop_gadgets_cache.json; and (4) generating shellcode that executes an arbitrary operator-provided command, with README examples including calc.exe, whoami redirection, account creation, and PowerShell. The script appears to support optional operator-supplied DLL files and base addresses to improve exploit reliability across targets. The code is not a framework module and appears to be an operational standalone exploit rather than a detector. It uses Python standard libraries plus optional pefile and ROPgadget for export parsing and gadget discovery. The main entry point is the script’s main() function, which parses CLI arguments, generates the ROP chain and shellcode, builds the exploit packet, sends it to the target, and performs a basic success verification step. Fingerprintable observables include UDP port 389, the hardcoded domain string dc.target.lab, local DLL paths and cache file names, and reference URLs in comments/README.

Small standalone PoC repository with 4 files: license/metadata, a detailed README, and one Python exploit script (`poc.py`). The script is not part of a larger exploitation framework. Its purpose is to demonstrate CVE-2026-41089, described as a pre-auth Netlogon CLDAP stack buffer overflow affecting Windows Domain Controllers. `poc.py` manually builds BER-encoded LDAP/CLDAP packets without third-party dependencies. Helper routines encode BER lengths, integers, enums, strings, and sequences, then assemble LDAP equality filters and an AND filter for `DnsDomain`, `User`, and `NtVer`. The exploit logic sends UDP CLDAP search requests to the target DC on port 389. Operational flow is three-phase: (1) send a normal ping using `testuser` to confirm the DC responds, (2) send an overflow attempt using a long username (default length 130, configurable with `-l`), and (3) after a short delay, send another normal ping to determine whether LSASS likely crashed. Main exploit capability: unauthenticated network-triggered denial of service against a vulnerable Domain Controller by corrupting the Netlogon CLDAP response-building path. The README claims potential RCE in theory, but the provided code does not include shellcode, ROP, memory corruption primitives beyond packet crafting, or any post-exploitation logic. As implemented, it is an operational DoS PoC that fingerprints success by loss of CLDAP responsiveness and expected reboot behavior. Fingerprintable targets are minimal and mostly operator-supplied: target IP, domain name, and UDP/389. The code embeds LDAP attribute names `DnsDomain`, `User`, and `NtVer`, and uses default `NtVer` value `0x00000016`. No hardcoded victim IPs, C2 infrastructure, or exfiltration endpoints are present.