Issue Description:

This is a zero-click, wormable vulnerability in the IPv6 TCP/IP stack of Microsoft Windows enables attackers to remotely execute arbitrary code on affected systems without any user interaction.

Asset Description:

The issue impacts Microsoft Windows versions that support IPv6. It is particularly risky for internet-facing Windows servers and user devices with IPv6 enabled.

Vulnerability Impact:

If successfully exploited, this vulnerability could allow attackers to remotely execute arbitrary code, which might result in a full system compromise, unauthorized data access, and/or exposure of sensitive information.

Exploitation Details:

The flaw is located in the IPv6 TCP/IP component of the Windows networking stack. Attackers can exploit this vulnerability by sending specially crafted IPv6 packets to a target machine, enabling RCE without user interaction.

Patch Availability:

Microsoft has issued a security update for this vulnerability as part of the August 2024 Patch Tuesday.
It is crucial for organizations to apply this update promptly to mitigate risks.
If immediate patching isn’t feasible, disabling IPv6 on affected Windows systems can help reduce the attack surface until the patch is applied.

# Check if the script is running with admin privileges
If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    # Restart script with admin privileges
    $arguments = "& '" + $myInvocation.MyCommand.Definition + "'"
    Start-Process powershell.exe -ArgumentList $arguments -Verb RunAs
    Exit
}

# Disable IPv6 on all network interfaces
Get-NetAdapterBinding -ComponentID ms_tcpip6 | Where-Object {$_.Enabled -eq $true} | ForEach-Object {
    Disable-NetAdapterBinding -Name $_.Name -ComponentID ms_tcpip6
}

# Optional: Confirm that IPv6 has been disabled
Write-Host "IPv6 has been disabled on all network interfaces."