search

chompie1337 / SMBGhost_RCE_PoC

1.3k stars 349 forks source link

Trying to detect (check) not to exploit the vulnerability #14

Open geffrix opened 4 years ago

geffrix commented 4 years ago

Hello!, anybody is trying to use this PoC to detect and not to exploit vulnerable systems? On not vulnerable systems I saw that "physical read primitive" fails, but in vulnerable systems the function "write_srvnet_buffer_hdr(ip, port, data, offset) - smb_compress(sock, compressed_data, 0xFFFFEFFF, dummy_data)" causes a BSOD. Do you have any ideas to modify the code in order to do a check of the vulnerability without causing a BSOD?

Best regards, Geffrey

Mdbset commented 4 years ago

The complexity of creating a vulnerability checker is PoC instability. Obtaining information from the server requires modifying the kernel memory of the OS, which in case of failure will lead to BSOD.