关联漏洞
标题：
微软 Microsoft SMBv3 缓冲区错误漏洞
(CVE-2020-0796)
描述：Microsoft SMBv3是美国微软（Microsoft）公司的一个为设备提供SMB功能的支持固件。 Microsoft Server Message Block 3.1.1 (SMBv3)版本中存在缓冲区错误漏洞，该漏洞源于SMBv3协议在处理恶意压缩数据包时，进入了错误流程。远程未经身份验证的攻击者可利用该漏洞在应用程序中执行任意代码。以下产品及版本受到影响：Microsoft Windows 10版本1903，Windows Server版本1903，Windows 10版本1909，Windo
描述
Scanner for CVE-2020-0796 - A SMBv3.1.1 + SMB compression RCE
介绍
# SMBGhost
This repository contains my scanner script which lets you know whether your server uses SMBv3.1.1 and has SMB compression enabled. Ultimately, this means you are vulnerable to [CVE-2020-0796](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796). At this point of time a security patch was released, please make sure to update!
It also offers a fully documented packet structure which can be utilized for further investigations targeting the SMB protocol.
Keep in mind that this scanner will only tell you whether you have SMBv3.1.1 and SMB compression enabled or not. It will mark a patched system as vulnerable as well!
## Usage
The module has extensive logging and requires the library `hexdump` which you can install with `pip3 install --user hexdump`. If you don't want logging you can use the script in `logless_scanner.py`.
```
python3 .\scanner.py 127.0.0.1 445
NetBIOS (4): 000000c0
Header (64): fe534d42400000000000000000001f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Negotiation (128): 24000800010000007f000000000000000000000000000000000000007800000002000000020210022202240200030203100311030000000001002600000000000100200001000100000000000000000000000000000000000000000000000000000000000000000003000a000000000001000000010000000100000000000000
Packet (196): 000000c0fe534d42400000000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024000800010000007f000000000000000000000000000000000000007800000002000000020210022202240200030203100311030000000001002600000000000100200001000100000000000000000000000000000000000000000000000000000000000000000003000a000000000001000000010000000100000000000000
```
Some output was ommited for the sake of a cleaner README. If you are vulnerable, the script will output the following text:
```
SMB version 0x311 with context 0x2 was found which indicates SMBv3.1.1 is being used and SMB compression is enabled, therefore being vulnerable to CVE-2020-0796!
```
## Workarounds
If you are unable to install the security patch provided by Microsoft please consider disabling SMB compression using the following command:
```powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
```
However, this will not protect you from getting exploited if you are the client connecting to an exploited machine.
文件快照
[4.0K] /data/pocs/e98bd7d158e7c5f197b4c5a94ff555b60f775c3f
├── [3.7K] logless_scanner.py
├── [2.5K] README.md
├── [4.0K] scanner.py
└── [ 48K] vulnerable.png
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。