关联漏洞
标题：
微软 Microsoft SMBv3 缓冲区错误漏洞
(CVE-2020-0796)
描述：Microsoft SMBv3是美国微软（Microsoft）公司的一个为设备提供SMB功能的支持固件。 Microsoft Server Message Block 3.1.1 (SMBv3)版本中存在缓冲区错误漏洞，该漏洞源于SMBv3协议在处理恶意压缩数据包时，进入了错误流程。远程未经身份验证的攻击者可利用该漏洞在应用程序中执行任意代码。以下产品及版本受到影响：Microsoft Windows 10版本1903，Windows Server版本1903，Windows 10版本1909，Windo
描述
PoC for triggering buffer overflow via CVE-2020-0796
介绍
# CVE-2020-0796 PoC aka CoronaBlue aka SMBGhost
## Usage
`./CVE-2020-0796.py servername`
This script connects to the target host, and compresses the authentication request with a bad offset field set in the transformation header, causing the decompressor to buffer overflow and crash the target.
This contains a modification of the excellent [smbprotocol](https://github.com/jborean93/smbprotocol) with added support for SMB 3.1.1 compression/decompression (only LZNT1). Most of the additions are in `smbprotocol/connection.py`. A version of [lznt1](https://github.com/you0708/lznt1) is included, modified to support Python 3.
The compression transform header is in the `SMB2CompressionTransformHeader` class there. The function `_compress` is called to compress tree requests. This is where the offset field is set all high to trigger the crash.
```python
def _compress(self, b_data, session):
header = SMB2CompressionTransformHeader()
header['original_size'] = len(b_data)
header['offset'] = 4294967295
header['data'] = smbprotocol.lznt1.compress(b_data)
```
## About
CVE-2020-0796 is a bug in Windows 10 1903/1909's new SMB3 compression capability. SMB protocol version 3.1.1 introduces the ability for a client or server to advertise compression cabilities, and to selectively compress SMB3 messages as beneficial. To accomplish this, when negotiating an SMB session, the client and server must both include a `SMB2_COMPRESSION_CAPABILITIES` as documented in [MS-SMB2 2.2.3.1.3](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/78e0c942-ab41-472b-b117-4a95ebe88271).
Once a session is negotiated with this capability, either the client or the server can selectively compress certain SMB messages. To do so, the entire SMB packet is compressed, and a transformed header is prepended, as documented in [MS-SMB2 2.2.42](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/1d435f21-9a21-4f4c-828e-624a176cf2a0). This header is a small (16 bytes) structure with a magic value, the uncompressed data size, the compression algorithm used, and an offset value.
CVE-2020-0796 is caused by a lack of bounds checking in that offset size, which is directly passed to several subroutines. Passing a large value in will cause a buffer overflow, and crash the kernel. With further work, this could be developed into a RCE exploit.
文件快照
[4.0K] /data/pocs/64d1d92636950c1b9ca98db74d3b22bc5a1ff2f9
├── [ 360] CVE-2020-0796.py
├── [1.1K] LICENSE
├── [2.3K] README.md
├── [ 162] requirements-test.txt
├── [ 193] setup.cfg
├── [1.6K] setup.py
├── [4.0K] smbclient
│ ├── [1006] __init__.py
│ ├── [ 17K] _io.py
│ ├── [ 53K] _os.py
│ ├── [5.3K] path.py
│ ├── [5.8K] _pool.py
│ ├── [4.0K] __pycache__
│ │ ├── [ 42K] _os.cpython-38.pyc
│ │ └── [5.1K] _pool.cpython-38.pyc
│ └── [ 21K] shutil.py
└── [4.0K] smbprotocol
├── [ 11K] change_notify.py
├── [ 65K] connection.py
├── [ 28K] create_contexts.py
├── [ 24K] exceptions.py
├── [ 29K] file_info.py
├── [1.6K] __init__.py
├── [ 17K] ioctl.py
├── [4.0K] lznt1.py
├── [ 55K] open.py
├── [ 393] query_info.py
├── [7.2K] reparse_point.py
├── [ 13K] security_descriptor.py
├── [ 27K] session.py
├── [7.7K] spnego.py
├── [ 33K] structure.py
├── [1.1K] _text.py
├── [4.2K] transport.py
└── [ 12K] tree.py
3 directories, 32 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。