CVE-2020-0796-SMBGhost-Exploit-Demo

Educational proof-of-concept exploit for CVE-2020-0796 (SMBGhost) demonstrating pre-auth RCE on Windows SMBv3. Includes step-by-step lab setup, offset calculation, and reverse shell execution for controlled cybersecurity training.

Demonstration: Step-by-Step Exploit

Step 1: Retrieve IP Addresses of Both VMs

1. Launch Command Prompt on both the Attacker and Target virtual machines.

2. Execute the following command in each machine:

   root@kitploit:~

   ipconfig
   

3. Take note of the IP addresses of the VMs — you’ll use them in the later steps.

Step 2: Calculate Offsets on Target VM

1. On the Target VM, navigate to the CVE-2020-0796-RCE-POC-master folder.
2. Double-click to run the script: calc_target_offsets.bat

• This will generate memory offsets required for the exploit.
• Keep the window open and take note of the values shown — you’ll use them in the next step.

Step 3: Update Exploit Script on Attacker VM

1. On the Attacker VM, open the same CVE-2020-0796-RCE-POC-master folder.
2. Right-click SMBleedingGhost.py and open with Notepad.
3. In the SMBleedingGhost.py file, scroll down and locate the section that begins with OFFSETS = {.
4. Replace the existing offset values with the ones you obtained from the Target VM.
5. Save the file after editing.
6. You may now close the offset window on the Target VM.

Step 4: Start Netcat Listener on Attacker VM

Open a new Command Prompt and run:

• This sets up a listener on port 4321 to receive a reverse shell from the Target VM upon successful exploitation.
• You can change the port number if needed.

Step 5: Execute Exploit from Attacker VM

1. Open another Command Prompt and navigate to the PoC directory (I saved mine in Desktop):

2. Run the exploit with the appropriate IPs and port:

Example used in this demo:

• 192.168.18.61: Target VM IP
• 192.168.18.62: Attacker VM IP
• 4321: Port used in the netcat listener

Exploitation Outcome

If successful, the netcat window will show:

This confirms that:

• The Target VM has been exploited
• The Attacker VM now has system-level privileges

You can validate access by executing:

This will give:

This means that the Attacker VM now has system-level privileges on the Target VM.

You can also run:

To verify you’re interacting with the Target VM’s network.

Note: The Target VM may crash after exploitation. If it does, you may restart it. The attacker session will need to be re-established after reboot.

Acknowledgements

This demonstration is based on the publicly available proof-of-concept developed by ZecOps.

All exploit code credit goes to ZecOps. I have only used and adapted it for educational purposes to demonstrate exploitation of CVE-2020-0796 within a controlled lab environment.

References

• CVE-2020-0796 Remote Code Execution POC

Author

@tdevworks

Disclaimer

This repository is created for educational purposes only.

All tools, scripts, and techniques demonstrated are intended to help understand cybersecurity vulnerabilities in a controlled lab environment. Do not attempt to use any of the provided materials on systems or networks that you do not own or have explicit permission to test.

Any misuse of the software will not be the responsibility of the author.