aioScan_CVE-2020-0796

Preface

Based on the public POC, using coroutines greatly improves detection speed, making it convenient for operations colleagues to quickly scan the internal network.

Affected Versions

Windows 10 Version 1903 for 32-bit Systems

Windows 10 Version 1903 for x64-based Systems

Windows 10 Version 1903 for ARM64-based Systems

Windows Server, Version 1903 (Server Core installation)

Windows 10 Version 1909 for 32-bit Systems

Windows 10 Version 1909 for x64-based Systems

Windows 10 Version 1909 for ARM64-based Systems

Windows Server, Version 1909 (Server Core installation)

Mitigation Recommendations

Refer to Microsoft's temporary solution ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression

Use PowerShell to disable SMBv3 compression (no reboot required)

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

Usage

Please run with Python 3.5 or above. Please run with Python 3.7 or above (since asyncio.run is a new API in 3.7, I only considered that async/await is a new syntax in 3.5)

IP address handling uses the third-party library netaddr

pip3 install netaddr

If you don't want to display IP information for connection timeouts, you can change line 39 to pass