CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates# DisableSMBCompression
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates
The little we know about the new SMB3 flaw, is that we've been provided this mitigation for SMB3 servers:
```
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
```
This repository contains ADMX templates to provide a nice interface to this setting. This allows easy mass deployment of the given mitigation, and easy rollback when desired.
# Installation
See this Microsoft guide for installing new admx files:
https://support.microsoft.com/en-au/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra
Under "Administrative Templates", find the new "SMB Compression Support" setting as below.
# Applicability
I recommend careful consideration before deploying outside of Windows 10 machines. Windows 2016 Server is not vulnerable, and only the SAC builds of Windows 2019 (which are Server Core only) are considered vulnerable. There has been little (no) QA done on the impact of this setting on server roles such as S2D. As always, please test a small group before a larger deployment.
The majority of environments don't appear to be running SMB compression in practice, but please consider whether this is suitable to you.
# Limitations
Nothing described as a "mitigation" should be considered a complete fix. Please roll patches as soon as they are out. This change disables compression on the local SMB server, where Microsoft's guide appears to suggest this can still be exploited to attack the client. See Microsoft's guidance for further information.
# References:
https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005
登录后查看神龙缓存的 POC 文件快照
登录查看