./CVE-2020-0796.py servername username password
This script connects to the target host with the provided username and password, and opens the IPC$ share. When the server receives a compressed packet after connecting to the tree, it BSoDs.
This contains a modification of the excellent smbprotocol with added support for sending compressed frames. Most of the additions are in smbprotocol/connection.py. A version of lznt1 is included, modified to support Python 3.
The compression transform header is in the SMB2CompressionTransformHeader class there. The function _compress is called to compress tree requests. This is where the offset field is set all high to trigger the crash.
def _compress(self, b_data, session):
header = SMB2CompressionTransformHeader()
header['original_size'] = len(b_data)
header['offset'] = 4294967295
header['data'] = smbprotocol.lznt1.compress(b_data)When updating this repo, my test VM updated with the patch, and (obviously) the PoC failed to crash it. When I tried downloading 1903/1909 installation images and installing them from the web, I was not able to replicate the crash. After reverting the update on my test VM, I was able to reproduce the crash again on the original VM. More testing is needed.
CVE-2020-0796 is a bug in Windows 10 1903/1909's new SMB3 compression capability. SMB protocol version 3.1.1 introduces the ability for a client or server to advertise compression cabilities, and to selectively compress SMB3 messages as beneficial. To accomplish this, when negotiating an SMB session, the client and server must both include a SMB2_COMPRESSION_CAPABILITIES as documented in MS-SMB2 2.2.3.1.3.
Once a session is negotiated with this capability, either the client or the server can selectively compress certain SMB messages. To do so, the entire SMB packet is compressed, and a transformed header is prepended, as documented in MS-SMB2 2.2.42. This header is a small (16 bytes) structure with a magic value, the uncompressed data size, the compression algorithm used, and an offset value.
CVE-2020-0796 is caused by a lack of bounds checking in that offset size, which is directly passed to several subroutines. Passing a large value in will cause a buffer overflow, and crash the kernel. With further work, this could be developed into a RCE exploit.