voidsec / cve-2020-1472

Exploit Code for CVE-2020-1472 aka Zerologon

About Voidsec 👋

Paolo Stagno (aka VoidSec) has worked as a Penetration Tester for a wide range of clients across top tier international banks, major tech companies and various Fortune 1000 industries.

He worked as a Vulnerability Researcher and Exploit Developer for Exodus Intelligence, where he was responsible for discovering and exploiting unknown vulnerabilities (zero days) in Windows OS, enterprise applications, network infrastructure components, IoT devices, new protocols, and technologies.

He is now the Director of Research at Crowdfense, focused on Windows OS offensive application security (kernel and user-land). He enjoys understanding our digital world, disassembling, reverse engineering and exploiting complex products and code.

In his own research, he discovered various vulnerabilities in software of multiple vendors and tech giants like eBay, Facebook, Fastweb, Google, HP, McAfee, Microsoft, Oracle, Paypal, TIM and many others.

Since the beginning of his career, he has enjoyed sharing his expertise with the security community with his website and blog (voidsec.com). He is also an active speaker in various security conferences around the globe like HITB, Typhooncon, Vulncon, Hacktivity, SEC-T, Droidcon, HackInBo, M0leCon, TOHack and Meethack.

A non-exhaustive list of public vulnerabilities and CVEs that he has discovered can be found at voidsec.com/advisories/

Contact me

Statistics

cve-2020-1472's Issues

WHY ??

(impacket) [ blackarch ~/impacket/examples/CVE-2020-1472 ]# ./cve-2020-1472-exploit.py -n WIN-279U4IB3LJE -t ...

---

|___ / | |
/ / ___ _ __ ___ | | ___ __ _ ___ _ __
/ / / _ \ '/ _ | |/ _ \ / ` |/ _ | ' \
./ /| / | | () | | () | (| | () | | | |
_____/_|| ___/||_/ __, |_/|| ||
/ |
|_/

Checker & Exploit by VoidSec

Performing authentication attempts...
Traceback (most recent call last):
File "/root/impacket/impacket/lib/python3.8/site-packages/impacket/dcerpc/v5/transport.py", line 346, in connect
self.__socket.connect(sa)
socket.timeout: timed out

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "./cve-2020-1472-exploit.py", line 155, in
main()
File "./cve-2020-1472-exploit.py", line 28, in main
perform_attack("\\" + dc_name, dc_ip, dc_name)
File "./cve-2020-1472-exploit.py", line 124, in perform_attack
rpc_con = try_zero_authenticate(dc_handle, dc_ip, target_computer)
File "./cve-2020-1472-exploit.py", line 37, in try_zero_authenticate
binding = epm.hept_map(dc_ip, nrpc.MSRPC_UUID_NRPC, protocol="ncacn_ip_tcp")
File "/root/impacket/impacket/lib/python3.8/site-packages/impacket/dcerpc/v5/epm.py", line 1256, in hept_map
dce.connect()
File "/root/impacket/impacket/lib/python3.8/site-packages/impacket/dcerpc/v5/rpcrt.py", line 801, in connect
return self._transport.connect()
File "/root/impacket/impacket/lib/python3.8/site-packages/impacket/dcerpc/v5/transport.py", line 349, in connect
raise DCERPCException("Could not connect: %s" % msg)
impacket.dcerpc.v5.rpcrt.DCERPCException: Could not connect: timed out
(impacket) [ blackarch ~/impacket/examples/CVE-2020-1472 ]#

pyfiglet.FontNotFound: doom

On Kali last release with python 3.8.6 and pyfiglet installed with both pip and apt-get:

python3.8 cve-2020-1472-exploit.py -n TEST -t 1.2.4.5

Traceback (most recent call last):
File "cve-2020-1472-exploit.py", line 155, in
main()
File "cve-2020-1472-exploit.py", line 28, in main
perform_attack("\\" + dc_name, dc_ip, dc_name)
File "cve-2020-1472-exploit.py", line 117, in perform_attack
banner = pyfiglet.figlet_format("Zerologon", "doom")
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 65, in figlet_format
fig = Figlet(font, **kwargs)
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 794, in init
self.setFont()
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 801, in setFont
self.Font = FigletFont(font=self.font)
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 126, in init
self.data = self.preloadFont(font)
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 147, in preloadFont
raise FontNotFound(font)
pyfiglet.FontNotFound: doom

pip install give me.. failed to build cryptography

HI there,
This is what i get with the:
pip install .

pip install .
Processing /home/ahmed/impacket
Collecting flask>=1.0
Using cached Flask-1.1.2-py2.py3-none-any.whl (94 kB)
Collecting ldap3!=2.5.0,!=2.5.2,!=2.6,>=2.5
Using cached ldap3-2.8.1-py2.py3-none-any.whl (423 kB)
Collecting ldapdomaindump>=0.9.0
Using cached ldapdomaindump-0.9.3-py3-none-any.whl (18 kB)
Collecting pyOpenSSL>=0.13.1
Using cached pyOpenSSL-19.1.0-py2.py3-none-any.whl (53 kB)
Collecting pyasn1>=0.2.3
Using cached pyasn1-0.4.8-py2.py3-none-any.whl (77 kB)
Collecting pycryptodomex
Using cached pycryptodomex-3.9.8-cp38-cp38-manylinux1_i686.whl (13.7 MB)
Requirement already satisfied: six in ./impacket/lib/python3.8/site-packages (from impacket==0.9.22.dev1+20200921.175010.84c8d6a7) (1.14.0)
Collecting Jinja2>=2.10.1
Using cached Jinja2-2.11.2-py2.py3-none-any.whl (125 kB)
Collecting click>=5.1
Using cached click-7.1.2-py2.py3-none-any.whl (82 kB)
Collecting itsdangerous>=0.24
Using cached itsdangerous-1.1.0-py2.py3-none-any.whl (16 kB)
Collecting Werkzeug>=0.15
Using cached Werkzeug-1.0.1-py2.py3-none-any.whl (298 kB)
Collecting dnspython
Using cached dnspython-2.0.0-py3-none-any.whl (208 kB)
Processing /home/ahmed/.cache/pip/wheels/8e/70/28/3d6ccd6e315f65f245da085482a2e1c7d14b90b30f239e2cf4/future-0.18.2-py3-none-any.whl
Collecting cryptography>=2.8
Using cached cryptography-3.1.tar.gz (534 kB)
Installing build dependencies ... done
Getting requirements to build wheel ... done
Preparing wheel metadata ... done
Collecting MarkupSafe>=0.23
Using cached MarkupSafe-1.1.1-cp38-cp38-manylinux1_i686.whl (31 kB)
Collecting cffi!=1.11.3,>=1.8
Using cached cffi-1.14.3-cp38-cp38-manylinux1_i686.whl (387 kB)
Collecting pycparser
Using cached pycparser-2.20-py2.py3-none-any.whl (112 kB)
Building wheels for collected packages: impacket, cryptography
Building wheel for impacket (setup.py) ... done
Created wheel for impacket: filename=impacket-0.9.22.dev1+20200921.175010.84c8d6a7-py3-none-any.whl size=1374151 sha256=c8c60311f38099ec7fe0e4f4523c89444e1844138aebb1b414f63761948c9fc8
Stored in directory: /tmp/pip-ephem-wheel-cache-h401g0th/wheels/f8/3e/b5/c9b66c82719b96f7269d01d0cc9e9a569a3a5e5d69b30b60a1
Building wheel for cryptography (PEP 517) ... error
ERROR: Command errored out with exit status 1:
command: /home/ahmed/impacket/impacket/bin/python /home/ahmed/impacket/impacket/lib/python3.8/site-packages/pep517/_in_process.py build_wheel /tmp/tmppn515ntc
cwd: /tmp/pip-install-v4spdmq4/cryptography
Complete output (137 lines):
running bdist_wheel
running build
running build_py
creating build
creating build/lib.linux-i686-3.8
creating build/lib.linux-i686-3.8/cryptography
copying src/cryptography/fernet.py -> build/lib.linux-i686-3.8/cryptography
copying src/cryptography/exceptions.py -> build/lib.linux-i686-3.8/cryptography
copying src/cryptography/utils.py -> build/lib.linux-i686-3.8/cryptography
copying src/cryptography/about.py -> build/lib.linux-i686-3.8/cryptography
copying src/cryptography/init.py -> build/lib.linux-i686-3.8/cryptography
creating build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/extensions.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/base.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/general_name.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/ocsp.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/certificate_transparency.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/init.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/name.py -> build/lib.linux-i686-3.8/cryptography/x509
copying src/cryptography/x509/oid.py -> build/lib.linux-i686-3.8/cryptography/x509
creating build/lib.linux-i686-3.8/cryptography/hazmat
copying src/cryptography/hazmat/_der.py -> build/lib.linux-i686-3.8/cryptography/hazmat
copying src/cryptography/hazmat/_oid.py -> build/lib.linux-i686-3.8/cryptography/hazmat
copying src/cryptography/hazmat/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat
creating build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/poly1305.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/keywrap.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/cmac.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/hashes.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/constant_time.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/hmac.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/padding.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
copying src/cryptography/hazmat/primitives/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives
creating build/lib.linux-i686-3.8/cryptography/hazmat/bindings
copying src/cryptography/hazmat/bindings/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/bindings
creating build/lib.linux-i686-3.8/cryptography/hazmat/backends
copying src/cryptography/hazmat/backends/interfaces.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends
copying src/cryptography/hazmat/backends/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends
creating build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/ed448.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/rsa.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/x25519.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/ed25519.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/utils.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/x448.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/ec.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/dsa.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/dh.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/padding.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
copying src/cryptography/hazmat/primitives/asymmetric/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/asymmetric
creating build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/kbkdf.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/concatkdf.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/scrypt.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/pbkdf2.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/hkdf.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/x963kdf.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
copying src/cryptography/hazmat/primitives/kdf/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/kdf
creating build/lib.linux-i686-3.8/cryptography/hazmat/primitives/twofactor
copying src/cryptography/hazmat/primitives/twofactor/totp.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/twofactor
copying src/cryptography/hazmat/primitives/twofactor/utils.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/twofactor
copying src/cryptography/hazmat/primitives/twofactor/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/twofactor
copying src/cryptography/hazmat/primitives/twofactor/hotp.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/twofactor
creating build/lib.linux-i686-3.8/cryptography/hazmat/primitives/serialization
copying src/cryptography/hazmat/primitives/serialization/pkcs7.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/serialization
copying src/cryptography/hazmat/primitives/serialization/base.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/serialization
copying src/cryptography/hazmat/primitives/serialization/ssh.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/serialization
copying src/cryptography/hazmat/primitives/serialization/pkcs12.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/serialization
copying src/cryptography/hazmat/primitives/serialization/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/serialization
creating build/lib.linux-i686-3.8/cryptography/hazmat/primitives/ciphers
copying src/cryptography/hazmat/primitives/ciphers/base.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/ciphers
copying src/cryptography/hazmat/primitives/ciphers/aead.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/ciphers
copying src/cryptography/hazmat/primitives/ciphers/modes.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/ciphers
copying src/cryptography/hazmat/primitives/ciphers/algorithms.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/ciphers
copying src/cryptography/hazmat/primitives/ciphers/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/primitives/ciphers
creating build/lib.linux-i686-3.8/cryptography/hazmat/bindings/openssl
copying src/cryptography/hazmat/bindings/openssl/binding.py -> build/lib.linux-i686-3.8/cryptography/hazmat/bindings/openssl
copying src/cryptography/hazmat/bindings/openssl/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/bindings/openssl
copying src/cryptography/hazmat/bindings/openssl/_conditional.py -> build/lib.linux-i686-3.8/cryptography/hazmat/bindings/openssl
creating build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/ed448.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/poly1305.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/rsa.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/cmac.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/x509.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/decode_asn1.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/x25519.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/encode_asn1.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/ed25519.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/utils.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/aead.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/ocsp.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/x448.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/hashes.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/ec.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/hmac.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/backend.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/dsa.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/dh.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/init.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
copying src/cryptography/hazmat/backends/openssl/ciphers.py -> build/lib.linux-i686-3.8/cryptography/hazmat/backends/openssl
running egg_info
writing src/cryptography.egg-info/PKG-INFO
writing dependency_links to src/cryptography.egg-info/dependency_links.txt
writing requirements to src/cryptography.egg-info/requires.txt
writing top-level names to src/cryptography.egg-info/top_level.txt
reading manifest file 'src/cryptography.egg-info/SOURCES.txt'
reading manifest template 'MANIFEST.in'
no previously-included directories found matching 'docs/_build'
warning: no previously-included files found matching 'vectors'
warning: no previously-included files matching '' found under directory 'vectors'
warning: no previously-included files found matching '.travis.yml'
warning: no previously-included files found matching '.travis'
warning: no previously-included files matching '' found under directory '.travis'
warning: no previously-included files matching '' found under directory '.github'
warning: no previously-included files found matching 'release.py'
warning: no previously-included files found matching '.coveragerc'
warning: no previously-included files found matching 'codecov.yml'
warning: no previously-included files found matching 'dev-requirements.txt'
warning: no previously-included files found matching 'rtd-requirements.txt'
warning: no previously-included files found matching 'tox.ini'
warning: no previously-included files matching '' found under directory '.zuul.d'
warning: no previously-included files matching '*' found under directory '.zuul.playbooks'
writing manifest file 'src/cryptography.egg-info/SOURCES.txt'
running build_ext
generating cffi module 'build/temp.linux-i686-3.8/_padding.c'
creating build/temp.linux-i686-3.8
generating cffi module 'build/temp.linux-i686-3.8/_openssl.c'
building '_openssl' extension
creating build/temp.linux-i686-3.8/build
creating build/temp.linux-i686-3.8/build/temp.linux-i686-3.8
i686-linux-gnu-gcc -pthread -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O2 -Wall -g -fstack-protector-strong -Wformat -Werror=format-security -g -fwrapv -O2 -g -fstack-protector-strong -Wformat -Werror=format-security -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC -I/home/ahmed/impacket/impacket/include -I/usr/include/python3.8 -c build/temp.linux-i686-3.8/_openssl.c -o build/temp.linux-i686-3.8/build/temp.linux-i686-3.8/_openssl.o -Wconversion -Wno-error=sign-conversion
build/temp.linux-i686-3.8/_openssl.c:575:10: fatal error: openssl/opensslv.h: No such file or directory
575 | #include <openssl/opensslv.h>
| ^~~~~~~~~~~~~~~~~~~~
compilation terminated.
error: command 'i686-linux-gnu-gcc' failed with exit status 1

ERROR: Failed building wheel for cryptography
Successfully built impacket
Failed to build cryptography
ERROR: Could not build wheels for cryptography which use PEP 517 and cannot be installed directly

Font path issue?

Hi there, I am getting the following error: (how do i fix this?)

raceback (most recent call last):
File "./cve-2020-1472-exploit.py", line 155, in
main()
File "./cve-2020-1472-exploit.py", line 28, in main
perform_attack("\\" + dc_name, dc_ip, dc_name)
File "./cve-2020-1472-exploit.py", line 117, in perform_attack
banner = pyfiglet.figlet_format("Zerologon", "doom")
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 65, in figlet_format
fig = Figlet(font, **kwargs)
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 794, in init
self.setFont()
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 801, in setFont
self.Font = FigletFont(font=self.font)
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 126, in init
self.data = self.preloadFont(font)
File "/usr/lib/python3/dist-packages/pyfiglet/init.py", line 147, in preloadFont
raise FontNotFound(font)
pyfiglet.FontNotFound: doom

many thanks.

AttributeError

With the latest impacket version:

[-] Do you want to continue and exploit the Zerologon vulnerability? [N]/y
y
Traceback (most recent call last):
File "cve-2020-1472-exploit.py", line 155, in
main()
File "cve-2020-1472-exploit.py", line 28, in main
perform_attack("\\" + dc_name, dc_ip, dc_name)
File "cve-2020-1472-exploit.py", line 136, in perform_attack
result = try_zerologon(dc_handle, rpc_con, target_computer)
File "cve-2020-1472-exploit.py", line 103, in try_zerologon
request = nrpc.NetrServerPasswordSet2()
AttributeError: module 'impacket.dcerpc.v5.nrpc' has no attribute 'NetrServerPasswordSet2'

What means during install procedures?

pwd
~/impacket/