CVE-2024-38063 - Windows TCP/IP Remote Code Execution Vulnerability. The occurrence of BSOD can lead to RCE while my code only causes BSOD. I am continuously analyzing the patch and testing to lead to the occurrence of RCE in the target system.

Star History

Overview

CVE-2024-38063 is a critical security vulnerability in the Windows TCP/IP stack that allows for remote code execution (RCE). The vulnerability is due to improper handling of IPv6 network packets by Windows, which can be exploited by an attacker to execute arbitrary code on a vulnerable system.

• CVE ID: CVE-2024-38063
• CVSS Score: 9.8 (Critical)
• Impact: Remote Code Execution
• Affected Components: Windows TCP/IP stack
• Exploitation Vector: Network (Remote)

Features

Attack Vectors

1. ICMP Flood Attack

   • Sends large volumes of ICMP packets to target
   • Configurable number of packet deliveries
   • Can cause network congestion and system instability

2. SYN Flood Attack

   • Sends TCP SYN packets with fragmented IPv6 headers
   • Uses random source ports
   • Can overwhelm target's connection handling capacity

3. Traffic Analysis

   • Real-time network traffic monitoring
   • Protocol distribution analysis
   • Packet size statistics
   • Traffic pattern visualization

4. Automated Reporting

   • Generates comprehensive PDF security reports
   • Includes traffic analysis graphs
   • Risk assessment and recommendations
   • Detailed vulnerability findings

5. IPv6 Discovery

   • Integration with v6disc for host discovery
   • Support for SLAAC, DHCPv6, and RFC 7217
   • Dual-stack discovery capabilities
   • Optional nmap integration

Prerequisites

• Python 3.x
• Required Python packages:
  • scapy
  • psutil
  • pandas
  • matplotlib
  • seaborn
  • numpy
  • fpdf
  • reportlab
• Root/Administrator privileges
• Network interface with IPv6 support

Installation

git clone https://github.com/ThemeHackers/CVE-2024-38063


pip3 install -r requirements.txt

Usage

python3 CVE-2024-38063.py --iface <network_interface> [--ipv6 <target_ipv6>] [--mac_addr <target_mac>] [--num_tries <number>] [--num_batches <number>]

Parameters

• --iface: Network interface(s) to use (comma-separated for multiple)
• --ipv6: Target IPv6 address (optional)
• --mac_addr: Target MAC address (optional)
• --num_tries: Number of tries per batch (default: 30)
• --num_batches: Number of batches (default: 30)

Affected Versions

This vulnerability affects all supported versions of Windows, including:

• Windows 10
• Windows 11
• Windows Server 2016, 2019, and 2022 (including Server Core installations)

Mitigation

1. Apply Security Updates

   • Install the latest Windows security patches
   • Enable automatic updates

2. Network Security

   • Implement proper IPv6 security controls
   • Enable IPv6 firewall rules
   • Monitor IPv6 traffic patterns
   • Implement rate limiting for ICMP traffic
   • Enable IPv6 packet filtering

3. System Hardening

   • Disable IPv6 if not required
   • Implement proper logging and monitoring
   • Regular security assessments

References

• Microsoft Security Advisory
• MalwareTech Analysis

Disclaimer

This tool is provided for educational and research purposes only. Use of this tool against systems without explicit permission is illegal. The authors are not responsible for any misuse or damage caused by this program.

Credits

Developed by:

• ThemeHackers
• Instagram