支持本站 — 捐款将帮助我们持续运营

目标: 1000 元,已筹: 1000

100.0%
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2020-0601 基础信息
漏洞信息

对漏洞内容有疑问?看看神龙的深度分析是否有帮助!
查看神龙十问 ↗

尽管我们使用了先进的大模型技术,但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性,但请您根据实际情况进行核实和判断。

Vulnerability Title
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Title
Microsoft Windows CryptoAPI 信任管理问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Microsoft Windows CryptoAPI是美国微软(Microsoft)公司的一个在Windows 操作系统中添加的密码编译机能。作为资料加密与解密功能的重要基础,CryptoAPI 支持同步,异步的密钥加密处理,以及操作系统中的数字证书 的管理工作。 Microsoft Windows CryptoAPI (Crypt32.dll)中验证椭圆曲线加密(ECC)证书的方法存在信任管理问题漏洞。攻击者可通过使用欺骗性的代码签名证书利用该漏洞签名恶意的可执行文件。以下产品及版本受到影响:Micr
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2020-0601 的公开POC
#POC 描述源链接神龙链接
1Remote Code Execution Exploit https://github.com/nissan-sudo/CVE-2020-0601POC详情
2Zeek package to detect CVE-2020-0601https://github.com/0xxon/cve-2020-0601POC详情
3A Windows Crypto Exploithttps://github.com/SherlockSec/CVE-2020-0601POC详情
4Nonehttps://github.com/JPurrier/CVE-2020-0601POC详情
5Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attemptshttps://github.com/0xxon/cve-2020-0601-pluginPOC详情
6PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)https://github.com/ly4k/CurveBallPOC详情
7A PoC for CVE-2020-0601https://github.com/kudelskisecurity/chainoffoolsPOC详情
8😂An awesome curated list of repos for CVE-2020-0601.https://github.com/RrUZi/Awesome-CVE-2020-0601POC详情
9Curated list of CVE-2020-0601 resourceshttps://github.com/BlueTeamSteve/CVE-2020-0601POC详情
10Proof of Concept for CVE-2020-0601https://github.com/saleemrashid/badecparamsPOC详情
11C++ based utility to check if certificates are trying to exploit CVE-2020-0601https://github.com/0xxon/cve-2020-0601-utilsPOC详情
12Powershell to patch CVE-2020-0601 . Complete security rollup for Windows 10 1507-1909https://github.com/Doug-Moody/Windows10_Cumulative_Updates_PowerShellPOC详情
13Nonehttps://github.com/MarkusZehnle/CVE-2020-0601POC详情
14CurveBall CVE exploitationhttps://github.com/YoannDqr/CVE-2020-0601POC详情
15Perl version of recently published scripts to build ECC certificates with specific parameters re CVE-2020-0601https://github.com/thimelp/cve-2020-0601-PerlPOC详情
16Repo containing lua scripts and PCAP to find CVE-2020-0601 exploit attempts via network traffichttps://github.com/dlee35/curveball_luaPOC详情
17CurveBall (CVE-2020-0601) - PoC CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography (ECC) is not correctly verified. Attackers can supply hand-rolled generators, bypassing validation, antivirus & all non-protections. https://github.com/IIICTECH/-CVE-2020-0601-ECC---EXPLOITPOC详情
18Nonehttps://github.com/Ash112121/CVE-2020-0601POC详情
19CVE-2020-0601 #curveball - Alternative Key Calculatorhttps://github.com/gentilkiwi/curveballPOC详情
20CVE-2020-0601: Windows CryptoAPI Vulnerability. (CurveBall/ChainOfFools)https://github.com/Hans-MartinHannibalLauridsen/CurveBallPOC详情
21PoC for "CurveBall" CVE-2020-0601https://github.com/apodlosky/PoC_CurveBallPOC详情
22PoC for CVE-2020-0601 - CryptoAPI exploithttps://github.com/ioncodes/CurveballPOC详情
23proof of concept for CVE-2020-0601https://github.com/amlweems/gringottsPOC详情
24PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll) POC: https://github.com/ollypwn/CurveBallhttps://github.com/yanghaoi/CVE-2020-0601POC详情
25Resources related to CurveBall (CVE-2020-0601) detectionhttps://github.com/talbeerysec/CurveBallDetectionPOC详情
26PoC for CVE-2020-0601 vulnerability (Code Signing)https://github.com/david4599/CurveballCertToolPOC详情
27这资源是作者复现微软签字证书漏洞CVE-2020-0601,结合相关资源及文章实现。推荐大家结合作者博客,理解ECC算法、Windows验证机制,并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者,自己确实很菜,但希望坚持下去,加油!https://github.com/eastmountyxz/CVE-2020-0601-EXPPOC详情
28这资源是作者复现微软签字证书漏洞CVE-2020-0601,结合相关资源及文章实现。推荐大家结合作者博客,复现了该漏洞和理解恶意软件自启动劫持原理。作为网络安全初学者,自己确实很菜,但希望坚持下去,一起加油!https://github.com/eastmountyxz/CVE-2018-20250-WinRARPOC详情
29CVE-2020-0601 proof of concepthttps://github.com/gremwell/cve-2020-0601_pocPOC详情
30Materials for the second Rijeka secuity meetup. We will be discussing Microsoft cryptoapi vulnerability dubbed CurveBall (CVE-2020-0601)https://github.com/bsides-rijeka/meetup-2-curveballPOC详情
31Nonehttps://github.com/exploitblizzard/CVE-2020-0601-spoofkeyPOC详情
32Implementing CVE-2020-0601https://github.com/ShayNehmad/twoplustwoPOC详情
33Nonehttps://github.com/okanulkr/CurveBall-CVE-2020-0601-PoCPOC详情
342017-0021https://github.com/cimashiro/-Awesome-CVE-2020-0601-POC详情
35simulation experiment of Curveball (CVE-2020-0601) attacks under ECQV implicit certificates with Windows-like verifiershttps://github.com/tyj956413282/curveball-plusPOC详情
36Demonstration of CVE-2020-0601 aka curveball. Based on the PoC's available at https://github.com/kudelskisecurity/chainoffools and https://github.com/ly4k/CurveBallhttps://github.com/JoelBts/CVE-2020-0601_PoCPOC详情
37Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/%E6%93%8D%E4%BD%9C%E7%B3%BB%E7%BB%9F%E6%BC%8F%E6%B4%9E/Windows%20CryptoAPI%20%E6%AC%BA%E9%AA%97%E6%BC%8F%E6%B4%9E%20CVE-2020-0601.mdPOC详情
AI 生成 POC高级

未找到公开 POC。

登录以生成 AI POC
三、漏洞 CVE-2020-0601 的情报信息
Please 登录 to view more intelligence information
四、漏洞 CVE-2020-0601 的评论

暂无评论


发表评论