## https://sploitus.com/exploit?id=A813D6F8-4191-58E1-BF7B-D23126B3AAB5
# CVE-2020-0796 (SMBGhost) — Red Team Project
### ITSOLERA Cybersecurity Department | Offensive Security Internship 2026
---
## Overview
This project researches, replicates, and documents **CVE-2020-0796 (SMBGhost)** —
a Critical (CVSS 10.0) integer overflow in the Windows SMBv3 compression handler
(`srv2.sys`), affecting Windows 10 Versions 1903 and 1909 (Builds 18362/18363).
The vulnerability allows:
- **Remote**: Unauthenticated wormable RCE over port 445
- **Local**: Low-privileged user → SYSTEM via loopback SMB (this project's focus)
> ⚠️ **Unlike web CVEs, this requires a real Windows 10 VM — no Docker.**
> Testing is restricted exclusively to the isolated lab VM.
---
## Key Difference From Web CVEs
| Web CVEs (Drupal, Apache) | SMBGhost |
|---|---|
| Docker container | Windows 10 VM (VMware/VirtualBox) |
| HTTP request payload | Kernel-level SMB packet |
| App-layer exploitation | Kernel memory corruption |
| Python HTTP requests | Python system checks + kernel exploit |
| Unprivileged web process | SYSTEM-level kernel code |
---
## Team Structure
| Member | Role | Key Deliverables |
|---|---|---|
| Member 1 | Lab Setup (Windows VM) | SETUP.md, verify_vulnerability.ps1, check_smb_config.ps1, config_notes.md |
| Member 2 | Exploit Framework | exploit.py, payloads.txt |
| Member 3 | Root Cause Analysis | root_cause_analysis.md, references.md, mitigation.md |
| Member 4 | Proof & Report | terminal_logs.txt, screenshots, CVE-2020-0796_Report.docx |
---
## Project Structure
```
CVE-2020-0796-Project/
├── README.md
├── lab/
│ ├── SETUP.md ← Windows VM setup guide
│ ├── verify_vulnerability.ps1 ← PowerShell vulnerability scanner
│ ├── check_smb_config.ps1 ← SMBv3 configuration audit
│ └── config_notes.md ← CVE conditions & VM notes
├── exploit/
│ ├── exploit.py ← Python LPE framework
│ └── payloads.txt ← Kernel exploit research notes
├── docs/
│ ├── root_cause_analysis.md ← Srv2DecompressData() deep dive
│ ├── references.md ← All sources
│ └── mitigation.md ← KB4551762 + hardening
├── proof/
│ ├── screenshots/ ← Exploitation screenshots
│ └── terminal_logs.txt ← Command output evidence
└── report/
└── CVE-2020-0796_Report.docx ← Final professional report
```
---
## Quick Start
### 1. Set Up the Lab VM
Follow `lab/SETUP.md` — Windows 10 Build 18362 or 18363, Windows Update disabled.
### 2. Verify the Target
Run in the VM (PowerShell as Admin):
```powershell
.\lab\verify_vulnerability.ps1
# Expected: SYSTEM IS VULNERABLE TO CVE-2020-0796
```
### 3. Take a Snapshot
VMware: VM → Snapshot → Take Snapshot → Name: "SMBGhost-Clean"
### 4. Run the Exploit Framework
As LabUser (standard user — not admin):
```cmd
python exploit\exploit.py --check-only
python exploit\exploit.py --safe-mode
python exploit\exploit.py --cmd "whoami"
```
### 5. Capture Evidence
```cmd
python exploit\exploit.py --cmd "whoami /all" --output proof\terminal_logs_system.txt
```
---
## CVE Summary
| Property | Value |
|---|---|
| CVE | **CVE-2020-0796** |
| Nickname | SMBGhost / CoronaBlue |
| CVSS v3 | **10.0 Critical** |
| Component | `srv2.sys` (Windows kernel driver) |
| Root Cause | Integer overflow in `Srv2DecompressData()` |
| Affected | Windows 10 1903 (Build 18362), 1909 (Build 18363) |
| Patch | KB4551762 (March 12, 2020) |
| Auth Required | None (RCE) / Low (LPE) |
---
## References
- MITRE: https://vulners.com/cve/CVE-2020-0796
- Microsoft MSRC: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0796
- chompie1337 PoC: https://github.com/chompie1337/SMBGhost_RCE_PoC
- ZecOps writeup: https://blog.zecops.com/vulnerabilities/exploiting-smbghost-cve-2020-0796-for-a-local-privilege-escalation-writeup/
- ExploitDB #48267: https://www.exploit-db.com/exploits/48267
---
*ITSOLERA Red Team Internship — Summer 2026*