SMBGhost (CVE-2020-0796) Automate Exploitation and Detection

This python program is a wrapper from the RCE SMBGhost vulnerability. All the credits for the working exploit to chompie1337. All the credits for the scanner to ioncodes.

I just automate these functions in one program. You need to have in mind the architecture of the Windows target when you are going to create the reverse shell.

This exploit is not stable, use at your own. Sometimes it doesn't work at the first time, this is why I added a second retry.

If you are going to put your own shellcode, have in mind that the shellcode max size is 600 bytes.

Tested on Windows 10 x64 (Microsoft Windows [Versión 10.0.18362.113]. Build 1903.)

DEMO

1º Stageless reverse shell (x64) created from msfvenom.

2º Trying custom shellcode to add user "di.security" as Administrator in the target. Credits for the shellcode to rastating

Options

usage: Smb_Ghost.py [-h] -i IP [-p PORT] [--check] [-e] [--lhost LHOST]
                    [--lport LPORT] [--arch ARCH] [--silent] [--shellcode]
                    [--load-shellcode LOAD_SHELLCODE]

SMBGhost Detection and Exploitation

optional arguments:
  -h, --help            show this help message and exit
  -i IP, --ip IP        IP address
  -p PORT, --port PORT  SMB Port
  --check               Check SMBGhost Vulnerability
  -e                    Directly exploit SMBGhost
  --lhost LHOST         Lhost for the reverse shell
  --lport LPORT         Lport for the reverse shell
  --arch ARCH           Architecture of the target Windows Machine
  --silent              Silent mode for the scanner
  --shellcode           Shellcode Menu to import your shell
  --load-shellcode LOAD_SHELLCODE
                        Load shellcode directly from file

Author

Alberto Barriuso (@_Barriuso)

Disclaimer

Any misuse of this software will not be the responsibility of the author. Use it at your own networks and/or with the network owner's permission.

TODO