seguridadentrerios/cve-2026-33829Automated Bash script to passively audit Windows assets for CVE-2026-33829 search: protocol handler vulnerability using tcpdump and SMB connection capture.
This repository contains an automated Bash tool designed to passively and controllably audit and verify whether Windows OS assets are vulnerable to insecure manipulation of the search: protocol handler.
The script acts as a passive listener, using tcpdump to capture outgoing connection attempts under the SMB (port 445) protocol when the target interacts with a specially crafted URI.
sudo) and the tcpdump package installed.Clone this repository or download the script verificar_search_uri.sh. Make sure to grant it execution permissions before starting.
# Asignar permisos de ejecución
chmod +x verificar_search_uri.sh
# Ejecutar el script indicando la interfaz local y la IP del objetivo Windows
sudo ./verificar_search_uri.sh <interfaz_red> <ip_windows>