skac44/cve-2024-38063Simulates CVE-2024-38063 TCP/IP remote code execution attack, captures network traffic with TShark, and trains a machine learning model to detect suspicious activity.
Windows Vulnerability that allows the implementation of unauthorised activity over the network: remote execution of Windows TCP/IP remote code.
Two virtual machines - a victim and an attacker - are ready to simulate the attack. On the victim machine, a tool for capturing network packets, TShark (command line mode of Wireshark), was used and the data was stored in .csv format. The next steps involve another virtual machine with a machine learning algorithm. The collected network data is then transferred to an analysis environment where important traffic metrics such as header mismatch, Destination Option fields, and others are extracted. These features are used to train a machine learning model that is able to identify suspicious activity.
