Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CurveBall — CVE-2020-0601: Windows CryptoAPI Vulnerability. (CurveBall/ChainOfFools) | Kitploit
Tools/GitHubGitHub/hans-martinhanniballauridsen/curveball
Vulnerability AnalysisExploitationCryptographyLearning & EducationBinary Exploitation
GitHubhans-martinhanniballauridsen/curveball

CurveBall

CVE-2020-0601: Windows CryptoAPI Vulnerability. (CurveBall/ChainOfFools)

View Repository

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
113 years agoNot yet reviewed

CurveBall (CVE-2020-0601) - PoC

CVE-2020-0601: Also known as CurveBall or ChainOffFools, is a vulnerability in the Microsoft CryptoApi (specificly in Crypt32.dll) where elliptic curve signatures (ECDSA) of certificates is not correctly verified.

There is a very nice blog post here which explains the issue very neatly.

This should only be used for educational and researching purposes!

How to

Provide the console application with the path to an elliptic curve certificate.

root@kitploit:~
CurveBall.exe 'PathToCA.cer'

The program will output a .p12 file contaning a certificate with the same public key and serial number as the original, including a key.

The key and cert can be extracted from the .p12 by using openssl with the following commands

root@kitploit:~
openssl pkcs12 -in Rogue.p12 -nocerts -out CA.key

and

root@kitploit:~
openssl pkcs12 -in Rogue.p12 -clcerts -nokeys -out CA.cer

NOTE: Default password is 'Test1234'.

Download Tool