/CVE-2020-0796-PoC

Primary LanguagePythonMIT LicenseMIT

CVE-2020-0796-PoC

Modified version of smbprotocol with basic support for sending compressed SMB packets. No support for decompressing from server, but none is needed for PoC to work. Requires lznt1 for LZNT1 compression.

Triggers an overflow in modern Windows systems with CVE-2020-0796 by setting the offset value in the compression transformation header to 0xFFFFFFFF. The memcpy which copies from the decompression workspace to the regular SMB packet handler does no bounds checking on this value.