CVE-2020-0796 PoC — 微软 Microsoft SMBv3 缓冲区错误漏洞

Source

Associated Vulnerability

Description

PoC for triggering buffer overflow via CVE-2020-0796

Readme

# CVE-2020-0796 PoC aka CoronaBlue aka SMBGhost

## Usage

`./CVE-2020-0796.py servername`

This script connects to the target host, and compresses the authentication request with a bad offset field set in the transformation header, causing the decompressor to buffer overflow and crash the target.

This contains a modification of the excellent [smbprotocol](https://github.com/jborean93/smbprotocol) with added support for SMB 3.1.1 compression/decompression (only LZNT1). Most of the additions are in `smbprotocol/connection.py`. A version of [lznt1](https://github.com/you0708/lznt1) is included, modified to support Python 3.

The compression transform header is in the `SMB2CompressionTransformHeader` class there. The function `_compress` is called to compress tree requests. This is where the offset field is set all high to trigger the crash.

```python
    def _compress(self, b_data, session):
        header = SMB2CompressionTransformHeader()
        header['original_size'] = len(b_data)
        header['offset'] = 4294967295
        header['data'] = smbprotocol.lznt1.compress(b_data)
```

## About

CVE-2020-0796 is a bug in Windows 10 1903/1909's new SMB3 compression capability. SMB protocol version 3.1.1 introduces the ability for a client or server to advertise compression cabilities, and to selectively compress SMB3 messages as beneficial. To accomplish this, when negotiating an SMB session, the client and server must both include a `SMB2_COMPRESSION_CAPABILITIES` as documented in [MS-SMB2 2.2.3.1.3](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/78e0c942-ab41-472b-b117-4a95ebe88271).

Once a session is negotiated with this capability, either the client or the server can selectively compress certain SMB messages. To do so, the entire SMB packet is compressed, and a transformed header is prepended, as documented in [MS-SMB2 2.2.42](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/1d435f21-9a21-4f4c-828e-624a176cf2a0). This header is a small (16 bytes) structure with a magic value, the uncompressed data size, the compression algorithm used, and an offset value.

CVE-2020-0796 is caused by a lack of bounds checking in that offset size, which is directly passed to several subroutines. Passing a large value in will cause a buffer overflow, and crash the kernel. With further work, this could be developed into a RCE exploit.

File Snapshot

 [4.0K]  /data/pocs/64d1d92636950c1b9ca98db74d3b22bc5a1ff2f9
├── [ 360]  CVE-2020-0796.py
├── [1.1K]  LICENSE
├── [2.3K]  README.md
├── [ 162]  requirements-test.txt
├── [ 193]  setup.cfg
├── [1.6K]  setup.py
├── [4.0K]  smbclient
│   ├── [1006]  __init__.py
│   ├── [ 17K]  _io.py
│   ├── [ 53K]  _os.py
│   ├── [5.3K]  path.py
│   ├── [5.8K]  _pool.py
│   ├── [4.0K]  __pycache__
│   │   ├── [ 42K]  _os.cpython-38.pyc
│   │   └── [5.1K]  _pool.cpython-38.pyc
│   └── [ 21K]  shutil.py
└── [4.0K]  smbprotocol
    ├── [ 11K]  change_notify.py
    ├── [ 65K]  connection.py
    ├── [ 28K]  create_contexts.py
    ├── [ 24K]  exceptions.py
    ├── [ 29K]  file_info.py
    ├── [1.6K]  __init__.py
    ├── [ 17K]  ioctl.py
    ├── [4.0K]  lznt1.py
    ├── [ 55K]  open.py
    ├── [ 393]  query_info.py
    ├── [7.2K]  reparse_point.py
    ├── [ 13K]  security_descriptor.py
    ├── [ 27K]  session.py
    ├── [7.7K]  spnego.py
    ├── [ 33K]  structure.py
    ├── [1.1K]  _text.py
    ├── [4.2K]  transport.py
    └── [ 12K]  tree.py

3 directories, 32 files

Remarks