CVE-2020-0796 PoC — 微软 Microsoft SMBv3 缓冲区错误漏洞

Source

Associated Vulnerability

Description

CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates

Readme

# DisableSMBCompression
CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates

The little we know about the new SMB3 flaw, is that we've been provided this mitigation for SMB3 servers:

```
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
```

This repository contains ADMX templates to provide a nice interface to this setting. This allows easy mass deployment of the given mitigation, and easy rollback when desired.

# Installation
See this Microsoft guide for installing new admx files:
https://support.microsoft.com/en-au/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra

Under "Administrative Templates", find the new "SMB Compression Support" setting as below.

![ADMX Template](https://github.com/technion/DisableSMBCompression/raw/master/SMBadmx.jpg)

# Applicability
I recommend careful consideration before deploying outside of Windows 10 machines. Windows 2016 Server is not vulnerable, and only the SAC builds of Windows 2019 (which are Server Core only) are considered vulnerable. There has been little (no) QA done on the impact of this setting on server roles such as S2D. As always, please test a small group before a larger deployment.

The majority of environments don't appear to be running SMB compression in practice, but please consider whether this is suitable to you.

# Limitations
Nothing described as a "mitigation" should be considered a complete fix. Please roll patches as soon as they are out. This change disables compression on the local SMB server, where Microsoft's guide appears to suggest this can still be exploited to attack the client. See Microsoft's guidance for further information.

# References:
https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005

File Snapshot

 [4.0K]  /data/pocs/5df57056b80e7acc01ff4c87fa689d451ec86c38
├── [1.0K]  LICENSE
├── [1.9K]  README.md
├── [ 56K]  SMBadmx.jpg
├── [ 991]  SMBCompression.adml
└── [1.5K]  SMBCompression.admx

0 directories, 5 files

Remarks