CVE-2020-0601-EXP

This resource is the author's reproduction of the Microsoft signature certificate vulnerability CVE-2020-0601, implemented by combining related resources and articles. It is recommended that you read the author's blog to understand the ECC algorithm, Windows verification mechanism, and try to reproduce examples of executable file signature certificates and HTTPS hijacking. As a beginner in cybersecurity, I am indeed still weak, but I hope to persevere. Keep it up!

This article will share the Microsoft certificate vulnerability CVE-2020-0601, explain the ECC algorithm and Windows verification mechanism, and reproduce an example of an executable file signature certificate. I hope this basic article is helpful to you, and I hope everyone improves their security awareness, learns relevant prevention measures, and is welcome to discuss.

[Cybersecurity Self-Study Series] 46. Microsoft Certificate Vulnerability CVE-2020-0601 (Part 1) Windows Verification Mechanism and Executable File Signature Reproduction](https://blog.csdn.net/Eastmount/article/details/104335673)

On January 15, Microsoft released a security patch for CVE-2020-0601. This vulnerability was introduced in Microsoft's implementation of Elliptic Curve Cryptography (ECC) algorithm digital certificate verification, located in the CryptoAPI.dll file. It can be exploited to forge signatures or certificates from trusted sources, and due to its business characteristics, it can spawn multiple attack vectors, with extremely high exploitability and great potential destructive power. Windows 10 and Windows Server 2016 & 2019 are also within its impact range.

GitHub resources:
[1] https://github.com/ollypwn/CurveBall
[2] https://github.com/kudelskisecurity/chainoffools
[3] https://github.com/saleemrashid/badecparams

1.EXE Certificate Vulnerability

2.HTTPS Hijacking Vulnerability