CVE-2020-0796
📋 TL;DR
CVE-2020-0796 (SMBGhost) is a critical remote code execution vulnerability in Microsoft's SMBv3 protocol compression feature. It allows attackers to execute arbitrary code on vulnerable Windows systems by sending specially crafted packets. This affects Windows 10 and Windows Server systems with SMBv3 enabled.
💻 Affected Systems
- Windows 10
- Windows Server 2019
- Windows Server, version 1903
- Windows Server, version 1909
📦 What is this software?
Windows 10 1903 by Microsoft
Windows 10 1903 by Microsoft
Windows 10 1903 by Microsoft
Windows 10 1909 by Microsoft
Windows 10 1909 by Microsoft
Windows 10 1909 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling lateral movement across networks, data theft, ransomware deployment, and persistent backdoor installation.
Likely Case
Remote code execution leading to malware installation, credential harvesting, and initial foothold for further network exploitation.
If Mitigated
Limited impact with proper network segmentation, SMB restrictions, and endpoint protection blocking exploit attempts.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist, including remote code execution and local privilege escalation variants. Exploitation requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: March 2020 security updates (KB4551762 for 1903, KB4551762 for 1909)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
Restart Required: Yes
Instructions:
1. Apply March 2020 Windows security updates via Windows Update. 2. For enterprise: Deploy patches through WSUS or SCCM. 3. Verify patch installation with 'systeminfo' command.
🔧 Temporary Workarounds
Disable SMBv3 Compression
windowsDisables the vulnerable compression feature in SMBv3 without disabling SMB entirely
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
Block SMB Ports at Firewall
windowsBlocks inbound SMB traffic on TCP port 445
New-NetFirewallRule -DisplayName "Block SMBv3" -Direction Inbound -LocalPort 445 -Protocol TCP -Action Block
🧯 If You Can't Patch
- Block TCP port 445 at network perimeter firewalls and segment SMB traffic internally
- Implement strict network access controls and monitor for SMB exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check Windows version with 'winver' and verify it's 1903 or 1909, then check if SMBv3 compression is enabled via registry key HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\DisableCompression (should be 0 or not exist if vulnerable)Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify KB4551762 is installed via 'systeminfo | findstr KB4551762' or check Windows Update history📡 Detection & Monitoring
Log Indicators:
- Event ID 4625 (failed logon) from SMB connections
- Windows Defender or antivirus alerts for exploit attempts
- Unexpected process creation from svchost.exe or lsass.exe
Network Indicators:
- Unusual SMB traffic patterns, especially to port 445
- SMB packets with compression headers from untrusted sources
- Network scans targeting port 445
SIEM Query:
source="windows" event_id=4625 OR event_id=4688 | where dest_port=445 OR process_name="svchost.exe" | stats count by src_ip🔗 References
- http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html
- http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
- http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html
- http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html
- http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796
