Microsoft Windows 10 (1903/1909) - (SMBGhost) SMB3.1.1 Local Privilege Escalation Exploit

🗓️ 30 Mar 2020 00:00:00Reported by Daniel García GutiérrezType

zdt🔗 0day.today👁 808 Views

Microsoft Windows 10 (1903/1909) SMBGhost SMBv3 LPE Exploi

Reporter	Title	Published	Views	Family All 207
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	8 Dec 202020:37	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	6 May 202015:20	–	gitee
Gitee	Exploit for CVE-2013-0422	20 Dec 202018:43	–	gitee
Gitee	Exploit for CVE-2013-0422	5 Aug 202014:46	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	6 Jul 202114:08	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	15 Nov 202122:01	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	4 Jun 202023:09	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	4 Jun 202010:07	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	20 Apr 202110:15	–	gitee
Gitee	Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft	11 Mar 202117:57	–	gitee

Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation

# CVE-2020-0796

Windows SMBv3 LPE Exploit

![exploit](https://user-images.githubusercontent.com/1675387/77913732-110d4f80-7295-11ea-9af6-f17201c66673.gif)

## Authors

  * Daniel García Gutiérrez ([@danigargu](https://twitter.com/danigargu))
  * Manuel Blanco Parajón ([@dialluvioso_](https://twitter.com/dialluvioso_))

## References

* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
* https://www.synacktiv.com/posts/exploit/im-smbghost-daba-dee-daba-da.html
* https://www.fortinet.com/blog/threat-research/cve-2020-0796-memory-corruption-vulnerability-in-windows-10-smb-server.html#.Xndfn0lv150.twitter
* https://www.mcafee.com/blogs/other-blogs/mcafee-labs/smbghost-analysis-of-cve-2020-0796/
* http://blogs.360.cn/post/CVE-2020-0796.html
* https://blog.zecops.com/vulnerabilities/vulnerability-reproduction-cve-2020-0796-poc/


Download ~ https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/48267.zip

30 Mar 2020 00:00Current

0.4Low risk

Vulners AI Score0.4

CVSS 27.5

CVSS 3.110

EPSS0.9981