Researchers have released proof-of-concept (PoC) exploits to show how local privilege escalation can take advantage of the Windows vulnerability tracked as SMBGhost and CV E-2020-0796.
Microsoft claims the bug patched in an out-of-band update on March 12 can be used on SMB clients and servers for remote code execution. The critical flaw of how SMB 3.1.1 manages such requests, which is described as “swordable,” affects the 1903 and 1909 release of Windows 10 and Windows Server.
Attacking SMB servers demands that the attacker send different packets to the network. The attacker has to convince the target user to connect to a compromised SMBv3 server for customers.
Researchers have developed tools to scan compromised servers and have released PoC exploits to achieve a DoS state. A PoC is not yet public for the remote code execution, but ZecOps has created and published a PoC showing that SMBGhost can be used to increase the privileges of Framework.
Researchers Daniel García Gutiérrez and Manuel Blanco Parajón also provided SMBGhost PoCs to improve SYSTEM’s privileges.
Researchers have released proof-of-concept (PoC) exploits to show how local privilege escalation can take advantage of the Windows vulnerability tracked as SMBGhost and CV E-2020-0796.
Microsoft claims the bug patched in an out-of-band update on March 12 can be used on SMB clients and servers for remote code execution. The critical flaw of how SMB 3.1.1 manages such requests, which is described as “swordable,” affects the 1903 and 1909 release of Windows 10 and Windows Server.
Attacking SMB servers demands that the attacker send different packets to the network. The attacker has to convince the target user to connect to a compromised SMBv3 server for customers.
Researchers have developed tools to scan compromised servers and have released PoC exploits to achieve a DoS state. A PoC is not yet public for the remote code execution, but ZecOps has created and published a PoC showing that SMBGhost can be used to increase the privileges of Framework.
We’ve just finished our first internet wide scan for CVE-2020-0796 and have identified 48000 vulnerable hosts. We’ll be loading this data into Telltale for CERTs and organisations to action. We’re also working on a blog post with more details (after patch).
— Kryptos Logic (@kryptoslogic) March 12, 2020
Researchers Daniel García Gutiérrez and Manuel Blanco Parajón also provided SMBGhost PoCs to improve SYSTEM’s privileges.
