关联漏洞
标题:Microsoft Windows 输入验证错误漏洞 (CVE-2013-3900)Description:Microsoft Windows是美国微软（Microsoft）公司的一套个人设备使用的操作系统。 Microsoft Windows WinVerifyTrust 函数处理可移植可执行文件(PE)的Windows Authenticode签名验证的方式中存在输入验证错误漏洞。匿名攻击者可以通过修改经过签名的现有可执行文件以利用文件的未验证部分来利用此漏洞，从而向文件添加恶意代码，而无需使签名无效。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完
Description
CVE PoC
介绍
# CVE-2013-3900-PowerShell-PoC
This PoC is provided for educational and research purposes only.
The author takes no responsibility for misuse or damage caused by this code.
This PowerShell script is a testing tool for simulating the attack described in CVE-2013-3900.
CVE-2013-3900 concerns the Authenticode mechanism in Windows, in which the PE signature (EXE/DLL files) may contain additional data (padding) in the certificate section. In older or default Windows settings, such a modification does not invalidate the signature, allowing malicious code to be added to the file while retaining its “signed” status.
By enabling EnableCertPaddingCheck=1 in the registry, the system begins to treat additional padding as a violation of integrity, rejecting such a file.
Script:
- Opens the selected signed EXE file.
- Adds artificial padding to the certificate section.
- Saves a modified copy of the file.
- Checks the signature of the original and the copy.
- Calls the WinVerifyTrust API to see if the system (with the current settings) will accept or reject the modified file.
If protection is enabled, the modified file will be rejected (0x800B0100); if disabled, it will be accepted (0x00000000).
I use MSBuild.exe because it is a Windows system file with an embedded Authenticode signature (not a catalog signature), which allows us to directly modify its certificate section and reliably simulate the CVE-2013-3900 vulnerability.
This makes the test repeatable and works on any Windows Server installation without the need to download additional files.
To run script:
```CMD
CMD C:\>powershell -ExecutionPolicy Bypass -File C:\CVE-2013-3900-PoC-padding-injection.ps1
```
Links:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
文件快照
[4.0K] /data/pocs/4a49531f2c913ddfd0a777674daa859e13a47938
├── [5.1K] CVE-2013-3900-PoC-padding-injection.ps1
├── [1.2K] LICENSE
├── [1.7K] README.md
└── [ 257] remediation-64bit-win.reg
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。