CVE-2020-0796-CNA

Modified based on the PoC provided by danigargu, implemented privilege escalation replication on Windows 10, and developed AggressorScripts based on the Reflective DLL project by stephenfewer and the interface provided by CobaltStrike documentation.

This repository is only for exchanging the implementation and testing of Reflective DLL injection, so no Release version is provided. Please compile it yourself.

Specific stability tests have not yet been conducted, welcome to discuss.

Affected Versions (Local Privilege Escalation + Remote Blue Screen)

• Windows 10 Version 1903 for 32-bit Systems
• Windows 10 Version 1903 for x64-based Systems
• Windows 10 Version 1903 for ARM64-based Systems
• Windows Server, Version 1903 (Server Core installation)
• Windows 10 Version 1909 for 32-bit Systems
• Windows 10 Version 1909 for x64-based Systems
• Windows 10 Version 1909 for ARM64-based Systems
• Windows Server, Version 1909 (Server Core installation)

Vulnerability Mitigation

1. Update the system

Steps: Settings -> Update & Security -> Windows Update, click 'Check for updates'.

2. Disable SMB compression

Run regedit.exe, open Registry Editor, create a DWORD named DisableCompression under HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters with a value of 1.

3. Block SMB communication on port 445 using a firewall

Patch address: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4551762

Implementation Principle

Recommended reading: Building Post-Exploitation Modules via Reflective DLL Injection (Lesson 1)