CVE-2024-38063 - SSP H3

For this setup(the one from the video) I've used Windows 22H2 19045 and build 2468. (this CVE is not patched until 4780)

I've tried this with Qemu/KVM but the network adapter was not coalescing the packets (from what i've investigated with tcpdump). The solution was to use VirtualBox, Host-Only network.

I've tried several PoCs (work smart, not hard):

• https://github.com/ThemeHackers/CVE-2024-38063
• https://github.com/haroonawanofficial/AI-CVE-2024-38063-0-DAY
• https://github.com/brownpanda29/Cve-2024-38063
• https://github.com/PumpkinBridge/Windows-CVE-2024-38063
• https://github.com/ynwarcs/CVE-2024-38063
• https://www.opswat.com/blog/comprehensive-breakdown-of-cve-2024-38063-a-critical-threat-in-the-windows-tcp-ip-stack

The solution was to use the last two (most stable). Even tough the last two didn't work, after tweaking the number of tries and batches the solution worked. Used ipconfig /all on the Windows VM to get the IPv6 addr and the mac and also I've used Get-NetIPv6Protocol to check that the coalescing was enabled(mainly RandomizeIdentifiers and UseTemporaryAddresses parameters).

To use the exploit you just need to run it with sudo so that scapy has the permision to custom craft packages and you need to replace the values of the IP target address, MAC target address, interface name, number of tries and the number of batches in the exploit.

sudo python3 exploit.py

You also need to install python3-scapy if you are using Debian based distros. You can use a custom venv env but you need to use the full path to the python bin from the venv so that it can use the required deps with sudo.