Do you your windows 10 PC/Laptop has been suddenly, crash and showing you BSOD (Blue Screen of Death) ?? well if yes is because someone out there has been running an windows 10 zero-day exploit against your computer, The exploit was relase in the wild on Githud in which anybody with technical Knowledge can use it to crash your millions of computer that has PC / laptop running windows 10 with the BSOD Screen been displaying
T
he Zero-Day was discovered by an researcher that goes by the by the name PythonResponder on Twitter, and who Published Proof-Of-Exploit code on GitHub On Wendesday
How does Windows 10 SMB zero-day works:
The Windows 10 zero-day discovered by PythonResponder is actually a memory corruption bug in the handling of SMB traffic that could be easily exploited by forcing a Windows system to connect to a malicious SMB share. However, to exploit the bug, a potential hacker has to trick a Windows 10 user into clicking a phishing link containing the exploit. Considering how easy it is to socially engineer such links, the zero-day could turn out to be quite effective.
The severeness of the bug has been noted by Carnegie Mellon’s Vulnerability Notes Database which has a new alert up for an exploit that can allow a remote attacker to crash a Windows 10 machine.
The vulnerability is yet to be patched by Microsoft and works on Windows 7/8.1 and Windows 10. The researcher says that he shared knowledge of the flaw with Microsoft, and claims that “they had a patch ready 3 months ago but decided to push it back.” Supposedly, the patch will be released next Tuesday.
Proof-of-Concept
Microsoft Windows fails to properly handle traffic from a malicious server. In particular, Windows fails to properly handle a specially-crafted server response that contains too many bytes following the structure defined in the SMB2 TREE_CONNECT Response structure. By connecting to a malicious SMB server, a vulnerable Windows client system may crash (BSOD) in mrxsmb20.sys. We have confirmed the crash with fully-patched Windows 10 and Windows 8.1 client systems, as well as the server equivalents of these platforms, Windows Server 2016 and Windows Server 2012 R2.
The PoC exploit has been tested by SANS ISC CTO Johannes Ullrich, and works on a fully patched Windows 10. You can read his full report here.
While this particular Windows 10 zero-day requires the hacker to create a malicious link containing the exploit, Windows 10 failure to correctly handle the SMB traffic means that somebody could discover a way to exploit it without user interaction/malicious link.
Mitigation
The only safe way for Windows 7/8.1 and Windows 10 PC/laptop owners to prevent this bug from being used against them is to avoid untrusted links. System administrators can prevent it from being exploited by blocking outbound SMB connections (TCP ports 139 and 445, UDP ports 137 and 138) from the local network to the WAN, as advised by CERT/CC. They should know that blocking this ports could also prevent users from accessing shared files, data, or devices.
Microsoft is believed to have accorded top priority to this Windows 10 zero-day and will release the patch this coming Tuesday.