关联漏洞
标题：
微软 Microsoft SMBv3 缓冲区错误漏洞
(CVE-2020-0796)
描述：Microsoft SMBv3是美国微软（Microsoft）公司的一个为设备提供SMB功能的支持固件。 Microsoft Server Message Block 3.1.1 (SMBv3)版本中存在缓冲区错误漏洞，该漏洞源于SMBv3协议在处理恶意压缩数据包时，进入了错误流程。远程未经身份验证的攻击者可利用该漏洞在应用程序中执行任意代码。以下产品及版本受到影响：Microsoft Windows 10版本1903，Windows Server版本1903，Windows 10版本1909，Windo
描述
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates
介绍
# DisableSMBCompression
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates
The little we know about the new SMB3 flaw, is that we've been provided this mitigation for SMB3 servers:
```
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
```
This repository contains ADMX templates to provide a nice interface to this setting. This allows easy mass deployment of the given mitigation, and easy rollback when desired.
# Installation
See this Microsoft guide for installing new admx files:
https://support.microsoft.com/en-au/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra
Under "Administrative Templates", find the new "SMB Compression Support" setting as below.
# Applicability
I recommend careful consideration before deploying outside of Windows 10 machines. Windows 2016 Server is not vulnerable, and only the SAC builds of Windows 2019 (which are Server Core only) are considered vulnerable. There has been little (no) QA done on the impact of this setting on server roles such as S2D. As always, please test a small group before a larger deployment.
The majority of environments don't appear to be running SMB compression in practice, but please consider whether this is suitable to you.
# Limitations
Nothing described as a "mitigation" should be considered a complete fix. Please roll patches as soon as they are out. This change disables compression on the local SMB server, where Microsoft's guide appears to suggest this can still be exploited to attack the client. See Microsoft's guidance for further information.
# References:
https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005
文件快照
[4.0K] /data/pocs/5df57056b80e7acc01ff4c87fa689d451ec86c38
├── [1.0K] LICENSE
├── [1.9K] README.md
├── [ 56K] SMBadmx.jpg
├── [ 991] SMBCompression.adml
└── [1.5K] SMBCompression.admx
0 directories, 5 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。