CurveBall

This repository is a proof-of-concept (PoC) for CVE-2020-0601, a critical vulnerability in Microsoft's Windows CryptoAPI (crypt32.dll) affecting ECC certificate validation. The exploit demonstrates how to manipulate ECC parameters to generate a spoofed CA private key from a public certificate, exploiting the flaw in Windows' certificate validation. The repository contains Ruby scripts (main.rb) in both 'source' and 'result' directories, which automate the process of reading a legitimate CA certificate, manipulating its ECC parameters, and outputting a spoofed private key (spoofed_ca.key). The result directory also contains example certificates and keys generated by the exploit, as well as configuration files for OpenSSL. The README provides background on the vulnerability and references to related resources. The exploit can be used to forge code-signing certificates or perform HTTPS interception attacks on unpatched Windows systems, demonstrating the real-world impact of the vulnerability.

This repository is a proof-of-concept (PoC) exploit for CVE-2020-0601 (CurveBall), a critical vulnerability in Microsoft's crypt32.dll affecting Windows 10 and related products. The vulnerability allows attackers to create spoofed ECC certificates that are trusted by Windows, due to improper validation of ECC parameters (specifically, the generator 'G'). The repository contains: - A Ruby script (main.rb) that manipulates the ECC parameters of a trusted Microsoft root CA certificate to generate a spoofed CA private key. - OpenSSL configuration files and example commands for generating and signing new certificates (for code signing or TLS) using the spoofed CA. - Example certificates and keys for both code signing and TLS scenarios. - A Node.js (Express) HTTPS server (tls/index.js) demonstrating the use of spoofed certificates in a TLS context. The exploit enables attackers to create certificates that Windows will trust for code signing or TLS, potentially allowing malicious code to be signed or man-in-the-middle attacks to be performed. The repository is structured to provide both code signing and TLS exploitation paths, with clear instructions and example files for each. No hardcoded network endpoints are present, but the default TLS certificate is configured for 'www.google.com', which can be changed as needed.

This repository provides a proof-of-concept (PoC) exploit for CVE-2020-0601, the Windows CryptoAPI (crypt32.dll) spoofing vulnerability, also known as 'CurveBall' or 'ChainOfFools'. The exploit demonstrates how to generate a rogue EC private key that matches the public key of a trusted root CA certificate using the P-384 curve. The main script, 'gen-key.py', takes a root certificate as input and produces a rogue private key ('p384-key-rogue.pem'). Using OpenSSL and provided configuration files ('ca.cnf', 'openssl.cnf'), the user can then generate a rogue CA certificate and sign arbitrary leaf certificates (e.g., for domains like *.microsoft.com, *.google.com, etc.). These forged certificates will be accepted as valid by vulnerable versions of Windows CryptoAPI, enabling man-in-the-middle or spoofing attacks. The repository includes a README with detailed instructions, a Python script for key generation, OpenSSL configuration files, and a requirements.txt for dependencies. No detection or scanning functionality is present; this is a functional PoC for certificate forgery exploiting the CVE-2020-0601 vulnerability.

This repository is a proof-of-concept (PoC) exploit for CVE-2020-0601, also known as 'Curveball', a critical vulnerability in Microsoft Windows CryptoAPI (crypt32.dll) affecting ECC certificate validation. The main exploit code is in 'Curveball/Curveball.cpp', a C program that uses OpenSSL to manipulate the EC_GROUP and EC_KEY structures of a provided ECC certificate. The program reads an original certificate file, extracts its public key, creates a new EC group with explicit parameters, and sets the private key to a known value (BN_value_one). It then writes out a new private key file that matches the manipulated public key. This allows an attacker to create a certificate/private key pair that will be accepted as valid by the vulnerable CryptoAPI, enabling attacks such as spoofing, MitM, or code signing. The repository includes a full OpenSSL header set for compilation but the exploit logic is contained in a single C file. The exploit is operational as a PoC and does not include weaponized automation or network delivery, but demonstrates the core cryptographic bypass. The main fingerprintable endpoints are the input and output certificate/key files.

This repository provides a proof-of-concept exploit for CVE-2020-0601 (CurveBall), a critical vulnerability in Windows CryptoAPI (crypt32.dll) affecting ECC certificate validation. The main exploit is implemented in `altkey/altkey.c`, a C program that takes an EC public certificate (in PEM format) as input and generates a new EC private key (with value 1) that matches the public key in the certificate. This demonstrates the ability to forge a private key for a given public key, exploiting the certificate validation flaw. The repository includes a full set of OpenSSL headers and build files for both Windows (Visual Studio project) and Linux. The exploit does not perform network operations; it is a local cryptographic attack tool. The README provides build instructions and usage examples, confirming the exploit's purpose and demonstrating its output. The exploit is a standalone POC and not part of a larger framework.

This repository is a proof-of-concept exploit for CVE-2020-0601 (also known as CurveBall or 'Windows CryptoAPI Spoofing Vulnerability'). The main exploit logic is implemented in 'badecparams.py', which generates a malicious intermediate CA certificate by exploiting improper validation of elliptic curve parameters in Windows CryptoAPI. This allows the attacker to issue fraudulent Authenticode and TLS certificates that are accepted as valid by vulnerable Windows systems and browsers (notably Microsoft Edge, Internet Explorer, and Chromium-based browsers prior to Chrome 79.0.3945.130). The script can generate certificates for arbitrary domains (e.g., nsa.gov, microsoft.com) and for code signing. The 'httpd.py' script is a simple HTTPS server that serves the contents of the 'www' directory using the generated certificates, demonstrating the attack in a browser. The repository includes a real certificate chain file ('comodoecccertificationauthority-ev-comodoca-com-chain.pem') as a base for the attack. The exploit does not provide a weaponized payload but demonstrates the vulnerability and its impact. The structure is clear: 'badecparams.py' for certificate generation/exploitation, 'httpd.py' for serving over HTTPS, and 'www/index.html' as demo content.

This repository is a C++ proof-of-concept (POC) exploit for CVE-2020-0601, a critical vulnerability in the Windows CryptoAPI (crypt32.dll) affecting the validation of ECC certificates. The exploit demonstrates how an attacker can generate a rogue CA certificate and a host certificate for an arbitrary domain (default: example.com) that will be accepted as valid by vulnerable Windows systems. The tool takes a trusted CA certificate as input, extracts its public key, and crafts a private key and CA certificate with matching parameters, exploiting the ECC parameter validation flaw. The generated certificates and keys are saved to disk for use in man-in-the-middle attacks, such as intercepting HTTPS traffic from vulnerable clients. The repository is structured as a CMake-based C++ project, with main logic in 'main.cpp' and 'cve-2020-0601_poc.cpp', and helper functions for OpenSSL operations in 'openssl-helper.cpp'. No hardcoded network endpoints are present, but the tool generates files that can be used to impersonate any domain. The exploit is a POC and does not include weaponized payloads or automation for network attacks, but provides all necessary components for a successful MITM attack against unpatched Windows systems.