🔐 CVE-2024-38063 — IPv6 TCP/IP Remote Code Execution Analysis

📌 Project Description

This project presents a technical analysis and practical demonstration of the critical vulnerability CVE-2024-38063, disclosed by Microsoft during Patch Tuesday (August 13, 2024).

The vulnerability affects the Windows TCP/IP stack, specifically the IPv6 component implemented in the kernel driver:

C:\Windows\System32\drivers\tcpip.sys

Discovered by security researcher XiaoWei from Kunlun Lab, this vulnerability may allow attackers to perform Remote Code Execution (RCE) by exploiting incorrect processing of IPv6 extension headers.

---

🎯 Objectives

• Understand why modern protocols may introduce security risks
• Analyze the technical root cause of CVE-2024-38063
• Reproduce the vulnerability in a controlled lab environment
• Execute a Proof of Concept (PoC)
• Identify mitigation strategies
• Develop practical defensive cybersecurity skills

---

🧠 Technical Explanation

Vulnerability Type

Integer Underflow → Buffer Overflow → Remote Code Execution

The vulnerability is located in the function:

Ipv6pProcessOptions()

inside the Windows kernel driver:

tcpip.sys

IPv6 introduces extension headers, which allow additional instructions to be included in network packets.

Improper handling of specially crafted IPv6 packets may cause:

• Integer underflow
• Memory corruption
• Buffer overflow
• System crash (BSOD)
• Potential remote code execution

Attackers exploit this weakness by sending malicious IPv6 fragmented packets containing manipulated extension headers.

---

💻 Affected Systems

The vulnerability impacts Windows operating systems where IPv6 is enabled by default:

• Windows 10
• Windows 11
• Windows Server 2008 → 2022
• Enterprise environments using IPv6 networking

---

🧪 Lab Environment

Machine	Role
Kali Linux	Attacker machine
Windows Server 2019	Target machine
VirtualBox NAT Network	Internal network

---

⚙️ Exploitation Scenario

1️⃣ Network Creation

Both virtual machines must belong to the same internal network.

VirtualBox configuration:

Tools → Network → NAT Network → Create

Example configuration:

Network address: 192.168.100.0/24
DHCP: Enabled

Network creation

---

2️⃣ Configure NAT Network for both machines

Both virtual machines must use the same NAT Network interface.

---

3️⃣ Assign static IP to Kali Linux

Manual configuration ensures stable connectivity.

---

4️⃣ Verify IP configuration

Confirm IP addresses are correctly assigned.

---

5️⃣ Connectivity test

Test communication between both machines.

---

📂 Proof of Concept (PoC)

The exploit demonstrates how malformed IPv6 packets can cause memory corruption.

Script Analysis

---

Running the exploit

Administrator privileges are required:

---

Result — Blue Screen of Death (BSOD)

Successful exploitation causes memory corruption leading to system crash.

---

⚠️ Ethical Notice & Lab Environment

This project was conducted strictly in a controlled and isolated virtual lab environment using virtual machines.

• All tests were performed locally using virtualization tools (VirtualBox)
• No real systems, networks, or external targets were involved
• The exploitation process was executed only on intentionally vulnerable machines

This work is part of an ethical hacking learning process and is intended solely for:

• Educational purposes
• Cybersecurity training
• Research and defensive analysis

🚫 Do NOT attempt to reproduce this attack on systems without explicit authorization.

Any misuse of this information is strictly discouraged.

---