0

Compulsory Task Report

Nihat Najafov
April 23th 2020

E-mail:nihat.najafov@gmail.com

Contents of Tables
 1

SMBv3 vulnerability CVE-2020-0796 2

Infected systems 2
How to Detect 3
Exploit Scripts 3

SMBv3 vulnerability CVE-2020-0796

What’s SMBv3 Vulnerability?
 2

This vulnerability can lead to remote code execution on the server, which is
always a major concern as far as the severity of vulnerabilities go. The version
affected specifically is 3.1.1, which is a more recent version. They mention
that this can be exploited from an unauthenticated attacker who sends a
specially crafted packet to a target the SMBv3 Server. This is extremely
similar to the SMBv1 vulnerability that I recently covered. The scary part about
this vulnerability is that it has been deemed ‘wormable’ which means if
someone were to exploit one of your machines, it can potentially spread from
machine to machine throughout your environment.It’s been identified that all
Windows 10 and Windows Server running version 1903 and 1909 are affected
by this.Then, on March 12, 2020, Microsoft released an unscheduled security
update KB4551762 for the SMBv3 vulnerability CVE-2020-0796

Infected Systems
+ Windows 10 Version 1903 for 32-bit Systems
+ Windows 10 Version 1903 for ARM64-based Systems
+ Windows 10 Version 1903 for x64-based Systems
+ Windows 10 Version 1909 for 32-bit Systems
+ Windows 10 Version 1909 for ARM64-based Systems
+ Windows 10 Version 1909 for x64-based Systems
+ Windows Server, version 1903 (Server Core installation)
+ Windows Server, version 1909 (Server Core installation

How to detect?
Rule snort
###############
# This rules will detect SMB compressed communication by the SMB protocol
identifier.
# The use of the offset and depth parameter is designed to prevent false
positives and to allow the NetBios Layer
 3

###############
alert tcp any any -> any 445 (msg:"Signature: SMBv3 Used with compression -
Client to server"; content:"|fc 53 4d 42|"; offset: 0; depth: 10; sid:1000001;
rev:1; reference:url,//blog.claroty.com/advisory-new-wormable-vulnerability-
in-microsoft-smbv3;)
alert tcp any 445 -> any any (msg:"Signature: SMBv3 Used with compression -
Server to client"; content:"|fc 53 4d 42|"; offset: 0; depth: 10; sid:1000002;
rev:1; reference:url,//blog.claroty.com/advisory-new-wormable-vulnerability-
in-microsoft-smbv3;)

Exploit Scripts

1)Bash

2)Python
4
5