Shulou(Shulou.com)05/31 Report--

CVE-2020-0796 complete analysis of what is, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain in detail for you, people with this need can come to learn, I hope you can gain something.

0x00 background

On March 10, 2020, foreign security vendors issued a security notice adding CVE-2020-0796 corresponding to the IPS rule, which is described as a vulnerability that can lead to remote arbitrary code execution without authentication [1].

A large number of secure media forwarded this announcement and believed that the vulnerability could lead to worm-like spread like WannaCry.

On March 11, the Microsoft Security Emergency response Center issued a security bulletin ADV200005. There is a remote code execution vulnerability in SBMv3 (3.1.1), which can be triggered by unauthorized users by sending specially constructed packets, resulting in arbitrary code execution [2]. Protective measures include disabling the compression function of SMBv3 through the registry and blocking the connection of port 445 through the firewall.

From the information released by Microsoft, the impact of the vulnerability is mainly in the 1903 and 1903 versions of the Windows system.

On March 12, Microsoft urgently released CVE-2020-0796 fix [3]. The development timeline of the incident is roughly as follows:

Construction and configuration of 0x01 Analysis Environment

System version: cn_windows_10_business_editions_version_1903_updated_nov_2019_x64_dvd_59670fa0.iso

Patch: windows10.0-kb4551762-x64_dacef156c781f2018d94d5a5286076610ba97279.msu

Enable network sharing:

Open Advanced sharing Settings (Settings-> status-> Network and sharing Center-> change Advanced sharing Settings or press the control panel path below to open) to enable network discovery and enable file and printer sharing.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.