Skip to content
Appaloosa Scout
Language selector
fr en

Materialized exploit

CVE-2020-0796

CRITICAL KEV

4 public exploit(s) for this CVE, 1 materialized with their code.

CVE page All exploits
For defensive research only. Only test on systems you own or have written authorization for. Unauthorized access is illegal.
Nuclei critical Verified
Source

Microsoft SMBv3 - Remote Code Execution

By projectdiscovery

How to test this exploit

The Nuclei template IS the test: an executable detection rule. Install nuclei, then run it against a target you control.

nuclei -id CVE-2020-0796 -u https://your-target

Template yaml 

id: CVE-2020-0796

info:
  name: Microsoft SMBv3 - Remote Code Execution
  author: Yusuf Amr
  severity: critical
  description: |
    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
  impact: |
    Unauthenticated attackers can exploit SMBv3 protocol handling vulnerabilities to execute arbitrary code on Windows 10 and Windows Server systems, enabling complete system compromise.
  remediation: |
    Apply Microsoft security updates that patch the SMBv3 protocol vulnerability in Windows 10 version 1903 and later as documented in Microsoft security advisory CVE-2020-0796.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0796
    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
    - https://github.com/tdevworks/CVE-2020-0796-SMBGhost-Exploit-Demo
    - http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html
    - http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2020-0796
    cwe-id: CWE-119
    epss-score: 0.9981
    epss-percentile: 0.99957
    cpe: cpe:2.3:o:microsoft:windows_10_1903:-:*:*:*:*:*:arm64:*
  metadata:
    vendor: microsoft
    product: windows_10_1903
    shodan-query: cpe:"cpe:2.3:o:microsoft:windows_10_1903"
    verified: true
  tags: cve,cve2020,microsoft,smb,kev,vkev,vuln

tcp:
  - host:
      - "{{Hostname}}"

    port: 445

    inputs:
      - data: "{{hex_decode(\"000000c2fe534d4240000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024000800000000007f0000000102abcd0102abcd0102abcd0102abcd7800000002000000020210022202240200030203100311030000000001002600000000000100200001000000000000000000000000000000000000000000000000000000000000000000000003000a0000000000010000000100000001000000000000000000\")}}"

        read: 8192

      - data: "{{hex_decode(\"000000a0fc534d42ffffffff0100000080000000fe534d424000000000000000010000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000001900000200000000000000005800280000000000000000004e544c4d5353500001000000329088e2000000002800000000000000280000000601b11d0000000f00000000000000000000000000000000\")}}"

    matchers-condition: and
    matchers:
      - type: binary
        part: data
        encoding: hex
        binary:
          - "fc534d4248000000"
          - "0d0000c0"
          - "1000602d00"
        condition: or

      - type: binary
        part: data
        encoding: hex
        binary:
          - "00000031fc534d424800000001000000000000001eb000fe534d4240000000c00d0000c00100011000602d00100103301e28090442"
# digest: 4a0a0047304502210099ef812630ae9ed21dda86eda170ac28795689d904ee11702969cabf1cf9207602201ff29a72bf8ad2555f599f8dd5346b51041042c4ecaea2aa3ebaaa3cbf504781:922c64590222798bb761d5b6d8e72950
ExploitDB remote windows
Source

Microsoft Windows - 'SMBGhost' Remote Code Execution

By chompie1337

How to test this exploit

Remote exploit. Target an isolated vulnerable instance (VM/lab), never a production system.

python3 48537.py

Code

Content not materialized yet (fetched on the next cycle).

View at source
ExploitDB local windows
Source

Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation

By Daniel García Gutiérrez

How to test this exploit

Local exploit. Run on a vulnerable install in a throwaway VM and verify the privilege escalation.

Code

Content not materialized yet (fetched on the next cycle).

View at source
ExploitDB dos windows
Source

Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC)

By eerykitty

How to test this exploit

Denial of service: sends malformed input to crash the service. Test in an isolated VM, the effect is destructive.

Code

Content not materialized yet (fetched on the next cycle).

View at source