|
1 | | -# Windows Protocol Test Suites |
| 1 | +# CVE-2020-0796 Pre-Auth POC |
2 | 2 |
|
3 | | -**Windows Protocol Test Suites** provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. |
| 3 | +(c) 2020 ZecOps, Inc. - https://www.zecops.com - Find Attackers' Mistakes |
| 4 | +POC to check for CVE-2020-0796 / "CoronaBlue" / "SMBGhost" |
| 5 | +Expected outcome: Blue Screen |
| 6 | +Intended only for educational and testing in corporate environments. |
| 7 | +ZecOps takes no responsibility for the code, use at your own risk. |
| 8 | +Please contact sales@ZecOps.com if you are interested in agent-less DFIR tools for Servers, Endpoints, and Mobile Devices to detect CoronaBlue and other types of attacks automatically. |
4 | 9 |
|
5 | | -Originally developed for in-house testing of the Microsoft Open Specifications, Microsoft Protocol Test Suites have been used extensively during Plugfests and interoperability labs to test against partner implementations. |
6 | | -A Test Suite evaluates whether a protocol or protocol family implementation meets certain interoperability requirements. |
7 | | -Test Suites do not cover every protocol requirement and in no way certify an implementation, even if all tests pass. |
8 | | -However, each test suite provides users with a useful indication of interoperability. |
| 10 | +## Usage |
9 | 11 |
|
10 | | -* **SMB1 Server Test Suite**. It covers the requirements documented by [MS-SMB], and those documented by other protocols which are related to [MS-SMB], i.e. [MS-FSCC] and [MS-CIFS]. |
11 | | -* **File Server Family Test Suite**. It is designed to test implementations of file server protocol family including [MS-SMB2], [MS-DFSC], [MS-SWN], [MS-FSRVP], [MS-FSA], [MS-RSVD] and [MS-SQOS]. |
12 | | -* **RDP Client Family Test Suite**. It provides interoperability testing for client implementation of RDP family protocols including [MS-RDPBCGR], [MS-RDPEDISP], [MS-RDPEDYC], [MS-RDPEGFX], [MS-RDPEGT], [MS-RDPEI], [MS-RDPEMT], [MS-RDPEUDP], [MS-RDPEUSB], [MS-RDPEVOR] and [MS-RDPRFX]. |
13 | | -* **RDP Server Family Test Suite**. It provides interoperability testing for server implementation of RDP family protocols including [MS-RDPBCGR], [MS-RDPEDYC], [MS-RDPEMT] and [MS-RDPELE]. |
14 | | -* **Kerberos Server Test Suite**. It is designed to test server implementations of Kerberos protocols including [MS-KILE], [MS-KKDCP] and [MS-PAC]. |
15 | | -* **SMBD Server Test Suite**. It is designed to test the implementations of SMB2&3 direct (RDMA) protocol, as specified in [MS-SMBD] and [MS-SMB2]. |
16 | | -* **Branch Cache Test Suite**. It is designed to test the implementations of [MS-PCCRTP], [MS-PCCRR], [MS-PCHC] and [MS-PCCRC] protocol. |
17 | | -* **AZOD Test Suite**. It is designed to test the implementations of [MS-AZOD] protocol. |
18 | | -* **ADFamily Test Suite**. It is designed to test the implementations of the Active Directory protocols including [MS-ADTS], [MS-APDS], [MS-DRSR] [MS-FRS2], [MS-LSAD], [MS-LSAT], [MS-SAMR] and [MS-NRPC]. |
19 | | -* **ADFSPIP Client Test Suite**. It is designed to test the implementations of ADFS Proxy and Web Application Proxy integration, as described in [MS-ADFSPIP]. |
20 | | -* **ADOD Test Suite**. It is designed to test the implementations of [MS-ADOD] protocol. |
| 12 | +`CVE-2020-0796-POC.exe [<TargetServer>]` |
21 | 13 |
|
22 | | -## Components |
23 | | -Windows Protocol Test Suites contain 4 components: |
| 14 | +If `<TargetServer>` is omitted, the POC is executed on localhost (`127.0.0.1`). |
24 | 15 |
|
25 | | -* **CommonScripts**. Common scripts used by each test suite. Normally they're used to deploy the environment. |
26 | | -* **ProtocolTestManager**. A UI tool to help you configure and run test cases. |
27 | | -* **ProtoSDK**. The protocol library used by each test suite. It provides the data structures of the protocol messages, the methods to encode and decode the messages, the methods to send and receive messages and etc. |
28 | | -* **TestSuites**. All Test Suites code and documents are saved here and categorized by folder representing each test suite. |
| 16 | +## Compiled POC |
29 | 17 |
|
| 18 | +You can get the compiled POC [here](https://github.com/ZecOps/CVE-2020-0796-POC/releases). |
30 | 19 |
|
31 | | -## Prerequisites |
32 | | -The Test Suites are developed and must be installed on a Windows platform. |
33 | | -You should install the software listed below based on your testing purpose, including their own dependencies. |
| 20 | +## Compiling |
34 | 21 |
|
35 | | -1. [Visual Studio](https://visualstudio.microsoft.com/downloads/) 2017 or higher ([Visual Studio 2017 Community](https://aka.ms/vs/15/release/vs_community.exe) recommended), installed with these individual components from the installer: |
36 | | - |
37 | | - |Section|Individual Component in Visual Studio 2017|Individual Component in Visual Studio 2019|Run Windows Protocol Test Suites|Build Windows Protocol Test Suites from source code| |
38 | | - |---|---|---|---|---| |
39 | | - |.NET|.NET Framework 4.7.1 SDK|.NET Framework 4.7.1 SDK||Required| |
40 | | - |.NET|.NET Framework 4.7.1 targeting pack|.NET Framework 4.7.1 targeting pack|Required|Required| |
41 | | - |Compilers, build tools, and runtime|C# and Visual Basic Roslyn compilers|C# and Visual Basic Roslyn compilers||Required| |
42 | | - |Compilers, build tools, and runtime|VC++ 2017 version 15.9 v14.16 latest v141 tools|MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)||Required<sup>[1](#footnote1)</sup>| |
43 | | - |Compilers, build tools, and runtime|Visual C++ 2017 Redistributable Update|C++ 2019 Redistributable Update|Required<sup>[1](#footnote1)</sup>|Required<sup>[1](#footnote1)</sup>| |
44 | | - |Debugging and testing|Testing tools core features||Required<sup>[2](#footnote2)</sup>|Required<sup>[2](#footnote2)</sup>| |
45 | | - |Developent Activities|Visual Studio C++ core features|C++ core features||Required<sup>[1](#footnote1)</sup>| |
46 | | - |SDKs, libraries, and frameworks|Windows 10 SDK (10.0.16299.0) for Desktop C++ [x86 and x64]|Windows 10 SDK (10.0.16299.0)||Required<sup>[1](#footnote1)</sup>| |
| 22 | +Use Visual Studio to compile the following projects: |
47 | 23 |
|
48 | | - Note: |
| 24 | +1. `ProtoSDK\Asn1Base\Asn1Base.csproj` |
| 25 | +2. `ProtoSDK\MS-XCA\Xca.csproj` |
| 26 | +3. `ProtoSDK\MS-SMB2\Smb2.sln` |
49 | 27 |
|
50 | | - <a name="footnote1">1</a>: This individual component is required by ADFamily, MS-SMBD or Protocol Test Manager which have C++ code. |
51 | | - |
52 | | - <a name="footnote2">2</a>: This individual component is installed in Visual Studio 2019 by default. |
53 | | - |
54 | | -1. [Spec Explorer 2010 v3.5.3146.0](https://visualstudiogallery.msdn.microsoft.com/271d0904-f178-4ce9-956b-d9bfa4902745/) |
55 | | - |
56 | | - It is required if you want to build or run the test suites. It is used to implement test scenarios and cases utilizing [Model-Based Testing](#Model-Based-Testing). |
57 | | - |
58 | | -1. [Protocol Test Framework build 1.0 (build 1.0.7500.0)](https://github.com/Microsoft/ProtocolTestFramework/releases/tag/1.0.7500.0) |
59 | | - |
60 | | - You can use a released MSI file or build it from source code. |
61 | | - |
62 | | -1. Enable .NET Framework 3.5.1 |
63 | | - |
64 | | - 1. _Turn Windows features on or off_ |
65 | | - 1. Enable _.NET Framework 3.5 (includes .NET 2.0 and 3.0)_ |
66 | | - |
67 | | - This is necessary for WiX Toolset. |
68 | | - |
69 | | -1. [WiX Toolset v3.14](https://wixtoolset.org/releases/v3-14-0-2927/) |
70 | | - |
71 | | -1. [WiX Toolset Visual Studio 2017 Extension](https://marketplace.visualstudio.com/items?itemName=WixToolset.WixToolsetVisualStudio2017Extension) or [Wix Toolset Visual Studio 2019 Extension](https://marketplace.visualstudio.com/items?itemName=WixToolset.WixToolsetVisualStudio2019Extension) |
72 | | - |
73 | | - WiX Toolset components required if you want to build test suites or Protocol Test Manager from source code. |
74 | | - |
75 | | -1. [NuGet CLI](https://www.nuget.org/downloads) |
76 | | - |
77 | | - It is required if you want to build Protocol Test Manager. Please download `nuget.exe` into a suitable folder and add that folder to `Path` environment variable |
78 | | - |
79 | | -1. Microsoft Message Analyzer |
80 | | - |
81 | | - It is required if you want to build or run ADFamily, ADOD and AZOD test suites. |
82 | | - |
83 | | - November 25 2019 - Microsoft Message Analyzer (MMA) has been retired and removed from public-facing sites on microsoft.com. A private MMA build is available for testing purposes; to request it, send an email to [getmma@microsoft.com](mailto:getmma@microsoft.com). |
84 | | - |
85 | | -1. [Open XML SDK](https://www.microsoft.com/en-us/download/details.aspx?id=30425) |
86 | | - |
87 | | - It is required if you want to build or run ADFamily test suite. |
88 | | - |
89 | | -1. [Network Direct DDK](https://www.microsoft.com/en-us/download/details.aspx?id=26645) |
90 | | - |
91 | | - From `NetworkDirect_DDK.zip` extract `ndspi.h` and `ndstatus.h` into project path `ProtoSDK\RDMA\include`. This is to build SMBD test suite. |
92 | | - |
93 | | - |
94 | | -You can use the script in `InstallPrerequisites` folder to automatically download and install these software. |
95 | | - |
96 | | -Tips when using the script in `InstallPrerequisites` folder: |
97 | | - |
98 | | -* To run the script, open **Windows PowerShell**, and execute the commands below in the **PowerShell Window**: |
99 | | - |
100 | | -``` |
101 | | -cd WindowsProtocolTestSuites\InstallPrerequisites |
102 | | -.\InstallPrerequisites.ps1 |
103 | | -``` |
104 | | - |
105 | | -* If you meet errors about **Execution Policy**, make sure you run **Windows PowerShell** as **Administrator**, and type the following and enter: |
106 | | - |
107 | | -``` |
108 | | -Set-ExecutionPolicy RemoteSigned |
109 | | -``` |
110 | | - |
111 | | -You could run the command below to verify if the **Execution Policy** is correctly set: |
112 | | - |
113 | | -``` |
114 | | -Get-ExecutionPolicy |
115 | | -``` |
116 | | - |
117 | | -Then rerun the script. |
118 | | - |
119 | | -## Model-Based Testing |
120 | | - |
121 | | -Some test suites use [Model-Based Testing](https://msdn.microsoft.com/en-us/library/ee620469.aspx): |
122 | | - |
123 | | -* **SMB1 Server Test Suite** |
124 | | -* **File Server Family Test Suite** |
125 | | -* **Kerberos Server Test Suite** |
126 | | -* **SMBD Server Test Suite** |
127 | | -* **BranchCache Server Test Suite** |
128 | | -* **ADFamily Test Suite** |
129 | | -* **ADFSPIP Client Test Suite** |
130 | | -* **AZOD Test Suite** |
131 | | -* **ADOD Test Suite** |
132 | | - |
133 | | -If you want to regenerate Model-Based Test cases, you must install Visual Studio 2012. |
134 | | - |
135 | | -## Build |
136 | | - |
137 | | -After you [clone a copy](https://help.github.com/articles/cloning-a-repository/) of this repo, you can run `build.cmd` for Protocol Test Manager and each test suite separately after you have installed all the softwares required for build listed in [Prerequisites](#prerequisites) |
138 | | - |
139 | | -### Build Protocol Test Manager |
140 | | - |
141 | | -``` |
142 | | -cd WindowsProtocolTestSuites\ProtocolTestManager |
143 | | -build.cmd |
144 | | -``` |
145 | | - |
146 | | -After the build succeeds, the MSI file of Protocol Test Manager should be generated in the folder `WindowsProtocolTestSuite\drop\ProtocolTestManager\installer\`. |
147 | | - |
148 | | -### Build a test suite |
149 | | - |
150 | | -``` |
151 | | -cd WindowsProtocolTestSuites\TestSuites\FileServer\src |
152 | | -build.cmd |
153 | | -``` |
154 | | - |
155 | | -After the build succeeds, the MSI file of each test suite should be generated in the folder `WindowsProtocolTestSuite\drop\TestSuites\\[TestSuiteName]\deploy\`. |
156 | | -Take File Server test suite as an example, `FileServer-TestSuite-ServerEP.msi` should be generated in the folder `WindowsProtocolTestSuite\drop\TestSuites\FileServer\deploy\`. |
157 | | - |
158 | | -## How to use test suites |
159 | | - |
160 | | -Take File Server test suite as an example, you can learn how to configure and run test suite by Protocol Test Manager referring to this [tutorial](./Doc/File%20Server%20SMB2%20Test%20Suite%20Lab%20Tutorial_v2.pdf). |
161 | | - |
162 | | -## Upgrade from an older version |
163 | | - |
164 | | -You can download and install the latest msi of test suites, Protocol Test Manager and Protocol Test Framework to upgrade them to the latest version. Or uninstall the old version and then install the new one. |
165 | | - |
166 | | -## Run |
167 | | - |
168 | | -After the build succeeds, you could set up the test environment, install Protocol Test Manager and install/configure/run the test suite according to its **User Guide**. |
169 | | -Each test suite has its own **User Guide** in the `WindowsProtocolTestSuites\TestSuites\[TestSuiteName]\docs` folder. |
170 | | -There are two more documents in the same folder: |
171 | | - |
172 | | -* **Technical Document**. The Open Specifications documentation for protocols, published by Microsoft. It's the basis of developing Test Suites. |
173 | | -* **Test Design Spec**. It provides information about the test scope and test suite design. |
174 | | - |
175 | | -## Contribute |
176 | | - |
177 | | -You can find contributing guide [here](./CONTRIBUTING.md). |
178 | | - |
179 | | -## License |
180 | | - |
181 | | -Windows Protocol Test Suites are under the [MIT license](./LICENSE.txt). |
182 | | - |
183 | | -## Contact |
184 | | -The following resources are for Windows protocol test suite news, discussion, and support: |
185 | | -* View news announcements in [Open Specification Windows Protocols Forum](https://social.msdn.microsoft.com/Forums/en-US/home?forum=os_windowsprotocols). |
186 | | -* Discuss test suites issues [here](./issues) on the github. |
187 | | -* For [Open Specifications Protocols](https://msdn.microsoft.com/en-us/library/gg685446.aspx) support, contact dochelp@microsoft.com. |
188 | | - |
189 | | -## Microsoft Open Source Code of Conduct |
190 | | -This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments. |
| 28 | +Use the resulting exe file to run the POC. |
0 commit comments