# Work-in-progress package to detect CVE-2020-0601 **URL:** \ **Category:** Zeek\ **Created:** [January 15, 2020, 2:42am UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969 "2020-01-15T02:42:19Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [January 15, 2020, 2:42am UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/1 "2020-01-15T02:42:19Z")
Hi, I assume most of you heard of CVE-2020-0601. If not - see the advisory at [https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601) and the descriptio nat [https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF](https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF). I have a small work-in-progress Zeek package that should be able to detect if someone is trying to exploit this in TLS communication, e.g. when impersonating a server. The package is available at [https://github.com/0xxon/cve-2020-0601;](https://github.com/0xxon/cve-2020-0601;) the script itself is very short and available at [https://github.com/0xxon/cve-2020-0601/blob/master/scripts/cve-2020-0601.bro](https://github.com/0xxon/cve-2020-0601/blob/master/scripts/cve-2020-0601.bro). How does it work ---
**Author:** ![Aashish\_Sharma1](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Aashish\_Sharma1](https://community.zeek.org/u/Aashish_Sharma1)\ **Post date:** [January 15, 2020, 5:13am UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/2 "2020-01-15T05:13:49Z")
Thanks Johanna - I must say quite timely package. ---
**Author:** ![Michal\_Purzynski1](https://avatars.discourse-cdn.com/v4/letter/m/a88e57/32.png) [@Michal\_Purzynski1](https://community.zeek.org/u/Michal_Purzynski1)\ **Post date:** [January 15, 2020, 5:51am UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/3 "2020-01-15T05:51:41Z")
Thanks a lot! Can we have that tweeted from the Zeek account? ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [January 15, 2020, 11:48pm UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/4 "2020-01-15T23:48:42Z")
Hello everyone, I just wanted to announce that there now is an updated package to detect CVE-2020-0601. The package is available at [https://github.com/0xxon/cve-2020-0601-plugin](https://github.com/0xxon/cve-2020-0601-plugin) But - before you run and install it - please read this email for more details on the package and the advantages/disadvantages over the old one. Due to the fact that not everyone will be able to use the new package, the old package will also stays available at [https://github.com/0xxon/cve-2020-0601](https://github.com/0xxon/cve-2020-0601) Description of new package ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [January 16, 2020, 5:30pm UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/5 "2020-01-16T17:30:47Z")
Hello everyone, in more news on this, I was just pointed to a POC for this - which is available at [https://github.com/ollypwn/cve-2020-0601](https://github.com/ollypwn/cve-2020-0601). Using this, I verified that both versions of the package successfully detect the exploit; I also added a test-case with a real exploit certificate to both packages (no other changes). As previously mentioned - if you run this and see any exploit activity, I would be really interested in hearing about it. Johanna ---
**Author:** ![Rick\_Chisholm](https://avatars.discourse-cdn.com/v4/letter/r/f17d59/32.png) [@Rick\_Chisholm](https://community.zeek.org/u/Rick_Chisholm)\ **Post date:** [January 16, 2020, 5:56pm UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/6 "2020-01-16T17:56:36Z")
You _could_ also point a browser in your environment at hxxps://[cve20200601.dshield.org](http://cve20200601.dshield.org) - they setup that site to test for vulnerable browser, but I found in testing that it also triggered my NSM. Excellent work on this plugin / script - very handy! ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [January 16, 2020, 6:21pm UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/7 "2020-01-16T18:21:24Z")
Hi, in even more news - after a suggestion of Justin, I updated the script in a way that lets you log suspicious certificates - in case you will want to dig into exploit attempts afterwards. Both versions of the plugin now have a setting (disabled by default) that will log all suspicious certificates encoded as base64. To enable this, update your package and redef CVE\_2020\_0601::log\_certs to true. Johanna ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/work-in-progress-package-to-detect-cve-2020-0601/5969/8 "2022-05-06T15:47:00Z")