diff --git a/docs/content/reference/exploiters/Zerologon.md b/docs/content/reference/exploiters/Zerologon.md index 499a050bf..78a88fdb5 100644 --- a/docs/content/reference/exploiters/Zerologon.md +++ b/docs/content/reference/exploiters/Zerologon.md @@ -21,10 +21,10 @@ is, therefore, **not** enabled by default. During successful exploitation, the Zerologon exploiter: -* will temporarily change the target domain controller's password. -* may break the target domain controller's communication with other systems in the network, affecting functionality. -* may change the administrator's password. -* will *attempt* to revert all changes. +* Will temporarily change the target domain controller's password. +* May break the target domain controller's communication with other systems in the network, affecting functionality. +* May change the administrator's password. +* Will *attempt* to revert all changes. While the Zerologon exploiter is usually successful in reverting its changes and restoring the original passwords, it sometimes fails. Restoring passwords @@ -58,12 +58,12 @@ to regain access to the system. #### Use Reset-ComputerMachinePassword -If you are able to login as the administrator, you can use the +If you are able to log in as the administrator, you can use the [Reset-ComputerMachinePassword](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1) powershell command to restore the domain controller's password. -#### Try a zerologon password restoration tool +#### Try a Zerologon password restoration tool If all other approaches fail, you can try the tools and steps found [here](https://github.com/risksense/zerologon).