CVE-2020-1350 SIGRed Denial of Service PoC Exploit

This repo has my version of a DoS PoC exploit for the SIGRed vulnerability disclosed by MS and Check Point Research on July 14th, 2020.

@maxpl0it also wrote a PoC that he published on July 15th, but I structured my exploit a little differently than they did so I thought it still presented value to release this for blue teams to increase their detections capabilities and provide another piece of data to test against.

This repo also has a PCAP for what this exploit looks like on the network.

Lab Environment

I tried rigging up the necessary domains to do this publicly but had some issues getting NS records to sync properly so I set this up internally in the DNS Service. So far as I'm aware, this shouldn't affect the efficacy of the exploit.

• Add a hosts file entry for your rogue DNS server (i.e. dnsexploitvm.lan in C:\Windows\System32\drivers\etc\hosts)
• Setup a Windows Server VM with the DNS Role
• Add a new zone for a TLD (I used lol because I didn't care about hijacking that TLD locally)
• Change the NS and SOA for that domain to your rogue DNS server (SOA might not be necessary)
• Add a new delegated zone in your TLD (i.e. hax.lol), and set the NS as your rogue DNS server