Windows TCP/IP IPv6 Remote Code Execution Vulnerability

Repository contains a single Python exploit script (exploit.py) plus documentation (README.md) and a refactor summary. The tool targets CVE-2024-38063 in the Windows IPv6 stack and is designed as a checker/DoS-style traffic generator. It uses Scapy to (1) optionally resolve the target MAC via IPv6 Neighbor Discovery (ICMPv6 Neighbor Solicitation) when a MAC is not provided, and (2) craft and transmit batches of malformed/corrupted IPv6 packets leveraging IPv6 extension headers (notably Destination Options and Fragment headers) at Ethernet layer (sendp). The code emphasizes robust/structured error handling (custom exception classes with error codes), configuration validation (IPv6/MAC format, safety limits on batch sizes), execution state tracking, and detailed logging. No external C2 or remote URLs are present; the only fingerprintable target observable is the default link-local IPv6 address used as a placeholder/target.

Repository contains a Scapy-based proof-of-concept for CVE-2024-38063 (Windows tcpip.sys IPv6 stack vulnerability) and a README describing the bug as an integer underflow during IPv6 extension-header parsing in fragmented traffic. The main script (CVE-2024-38063.py) resolves the target’s MAC address (getmac) and then floods the local network segment with crafted Ethernet frames carrying IPv6 packets: a Destination Options header with an unrecognized option type (PadN otype=0xBD) followed by a two-fragment sequence (same fragment id, m=1 then m=0) and a large dummy payload. It repeats these packets in nested loops (10x10) and duplicates each 3-packet set, varying hop limit and fragment id to increase trigger reliability. The intended outcome is denial-of-service (BSOD) on vulnerable Windows hosts within ~30–60 seconds; despite README discussion of potential RCE, the code does not implement a code-execution payload—this is a crash/flood PoC. No C2 or external attacker-controlled endpoints are present; the only network targets are the configured interface and the victim IPv6 address on the local link.

Repository contains a minimal Python/Scapy proof-of-concept for CVE-2024-38063 targeting the Windows TCP/IP IPv6 stack. Structure: (1) README.md explains environment constraints (Windows 22H2 build 19045.2468; notes about patch level), recommends VirtualBox host-only networking due to packet coalescing behavior, and instructs running as root with Scapy installed; (2) exploit.py crafts and transmits large batches of IPv6 packets. Exploit behavior: exploit.py defines retries=100 and batches_size=100, then builds a payload list by repeatedly generating a 3-packet sequence per iteration (Destination Options with PadN option type 0x81, followed by two IPv6 Fragment packets sharing a fragment ID with m=1/offset=0 and m=0/offset=1). It duplicates each generated sequence to increase trigger probability, then sends all packets at layer-2 using Scapy sendp() on a specified interface (default 'eth0'). After sending, it waits 60 seconds (likely to observe target crash/behavior). No command execution, callback, or shellcode is included; the capability is network-triggered fault/DoS-style exploitation attempt against a specific IPv6 target.

This repository provides a proof-of-concept exploit for CVE-2024-38063, a Windows TCP/IP stack vulnerability that can lead to remote code execution via specially crafted IPv6 packets. The main exploit script (Attack VM/cve-2024-38063.py) uses Scapy to generate and send batches of IPv6 packets with custom extension headers and fragmentation fields to a specified target IPv6 address and MAC address. The exploit is designed to trigger memory corruption on a Windows system with IPv6 enabled. The repository is structured to support a full attack simulation and detection pipeline: - The 'Attack VM' directory contains the exploit script and a bash runner. - The 'Victim VM' directory provides scripts for capturing network traffic (using TShark) and sending the captured data to a machine learning analysis VM via SFTP. - The 'ML VM' directory contains scripts for training and running a machine learning model to detect the exploit in captured network traffic, using features extracted from packet captures. The exploit is network-based and targets Windows systems over IPv6. The repository also includes a test script for generating benign IPv6 traffic and a sample packet capture CSV. The machine learning component is intended to help identify the exploit's network signature in real-world traffic. No weaponized or highly automated payload is included; the exploit is a proof-of-concept for research and detection development.

This repository contains a Python 3 exploit script (ai-fuzzer-cve-2024-38063-0-day.py) targeting CVE-2024-38063, an IPv6 fragment underflow vulnerability. The script uses Scapy and netifaces to discover IPv6 hosts on the local network (link-local fe80::/10 addresses) and sends specially crafted IPv6 fragments to test for the vulnerability. It supports multiple modes: scanning for vulnerable hosts, attempting to crash targets, and a placeholder for RCE. The script can use an AI model (GPT-2 via transformers) to mutate payloads for fuzzing, but falls back to random data if unavailable. Results can be logged to a user-specified file. The repository also includes a README with links to further documentation and root cause analysis. The exploit is a proof-of-concept and does not include a weaponized payload, but demonstrates the vulnerability and provides a framework for further research or exploitation.

This repository contains a Python-based exploit tool targeting CVE-2024-38063, a critical vulnerability in certain versions of Microsoft Windows related to improper handling of fragmented IPv6 Neighbor Discovery packets. The main script, 'exploit.py', automates the process of discovering vulnerable Windows systems using the Shodan API, verifies their susceptibility, and executes a Denial of Service (DoS) attack by sending specially crafted IPv6 packets using Scapy. The exploit is operational: it includes both reconnaissance (via Shodan) and an actual exploit payload (malformed IPv6 packets) that can crash the target system (BSOD). The tool requires a valid Shodan API key and network access to the target's IPv6 address. The repository is structured with a main exploit script, a requirements file for dependencies, a README with detailed usage instructions, and a license file. No hardcoded IPs or domains are present; targets are dynamically discovered via Shodan. The exploit is not part of a larger framework and is self-contained.

This repository provides proof-of-concept and exploit code for CVE-2024-38063, a critical remote code execution vulnerability in the Windows TCP/IP stack. The exploit is implemented in Python using the Scapy library to craft and send specially formed IPv6 packets, including fragmented packets and destination options headers. The three main Python scripts (Cve-2024-37063-poc.py, Cve-2024-38063-rce.py, and Cve-rce2.py) all follow a similar structure: they allow the user to specify a target IPv6 address (and optionally a MAC address and network interface), generate batches of malformed IPv6 packets, and send them to the target. The RCE scripts (notably Cve-2024-38063-rce.py and Cve-rce2.py) include the ability to insert custom shellcode into the payload, aiming to achieve remote code execution if the vulnerability is present and successfully exploited. The README provides context, CVSS metrics, and usage warnings. No hardcoded IPs or MACs are present; the user must supply these at runtime. The exploit is operational, requiring some adaptation (e.g., shellcode and target details) but is not a mere proof-of-concept. The attack vector is network-based, targeting Windows systems with vulnerable TCP/IP stacks via IPv6 traffic.

This repository contains a single Python proof-of-concept exploit (CVE-2024-38063_DKob_N3TCR4SH.py) targeting CVE-2024-38063, a vulnerability in the Windows kernel's handling of IPv6 fragmented packets with specific destination options. The exploit uses Scapy to craft and send batches of malicious IPv6 packets at Layer 2 (Ethernet) to a user-specified target MAC and IPv6 address. The script is interactive, prompting the user for the network interface, target MAC and IPv6 addresses, and the number of packets and batches to send. The goal is to trigger a denial-of-service or kernel instability on the target system. The repository also includes detailed documentation (Documentation.md) explaining the code structure and logic, and a README summarizing the exploit's purpose and providing links to further resources. No hardcoded endpoints are present; all target information is supplied by the user at runtime.

This repository contains two Python scripts, '2.py' and 'rce.py', both of which are nearly identical in structure and function. Each script is designed to exploit a vulnerability in the handling of fragmented IPv6 packets by sending a series of specially crafted packets to a target IPv6 address. The scripts use the Scapy library to construct and send these packets, optionally at the Ethernet layer if a MAC address is provided. The payload delivered is a Windows shellcode, embedded as a byte string, which is inserted into the fragmented packets. The scripts automate the sending of multiple batches of these packets to increase the likelihood of successful exploitation. The exploit is operational and requires the attacker to specify the target's IPv6 address, and optionally its MAC address and network interface. The main purpose of the repository is to achieve remote code execution or trigger memory corruption on a vulnerable target by exploiting flaws in IPv6 packet reassembly.

This repository contains a proof-of-concept exploit for CVE-2024-38063, a remote code execution vulnerability in the Windows tcpip.sys kernel driver affecting IPv6 packet processing. The repository consists of a Python script (script/cve-2024-38063.py), a README.md with detailed usage and technical background, and a LICENSE file. The exploit script uses the Scapy library to craft and send batches of malformed IPv6 packets (with destination options and fragmented headers) to a specified target IPv6 address. The exploit aims to trigger a memory corruption in the target's kernel by exploiting a logic flaw in how coalesced packets and extension headers are processed. The README provides extensive troubleshooting and configuration guidance, including the need for the target to be reachable via IPv6 and to have packet coalescing enabled (e.g., by using kdnic.sys as the network adapter driver). The exploit does not provide a direct shell or code execution payload but demonstrates the ability to trigger the underlying vulnerability, making it a proof-of-concept. No hardcoded network endpoints are present; the user must supply the target's IPv6 address and, optionally, its MAC address.

This repository contains a Python proof-of-concept exploit for CVE-2024-38063, a Windows TCP/IP Remote Code Execution Vulnerability. The main file, BSOD.py, is a command-line tool that allows the user to specify a network interface, target IPv6 address, and target MAC address. The script uses the Scapy library to craft and send a series of malformed IPv6 packets, including destination options and fragmented headers, to the specified target. The exploit aims to trigger memory corruption or a denial of service (such as a Blue Screen of Death) on vulnerable Windows systems. The script provides two main attack modes: an ICMP flood and a targeted packet attack. The README is minimal and only references the CVE. No hardcoded endpoints are present; the user must supply the target's IPv6 and MAC addresses at runtime. The code is a functional proof-of-concept and not weaponized, but demonstrates the vulnerability's impact.

This repository contains a single Nmap NSE script (cve-2024-38063.nse) designed to exploit CVE-2024-38063 by performing IPv6-based network attacks. The script allows the user to specify a target IPv6 address and network interface, and then launches both ICMPv6 Echo Request (ping) floods and TCP SYN floods against the target. The script also includes a function to send a generic exploit packet with a simple payload. The code is written in Lua and intended to be run via Nmap's scripting engine. The main entry point is the 'action' function, which coordinates the attack based on user-supplied arguments. The exploit is a proof-of-concept for IPv6 DoS attacks and does not include advanced payloads or post-exploitation features. No hardcoded endpoints are present; all targets are user-supplied at runtime.

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-38063, authored by @ynwarcs. The main file, 'CVE-2024-38063-poc.py', is a Python script that uses the scapy library to craft and send a series of specially constructed IPv6 packets to a target system. The exploit targets a vulnerability in the IPv6 stack, sending batches of fragmented and destination-option-laden packets to the specified IPv6 address. The script allows the user to configure the network interface, target IPv6 address, and optionally the MAC address. The README provides usage instructions and cautions that the exploit can crash the target system, recommending use in a VM. The exploit is a PoC and primarily demonstrates a denial-of-service (DoS) condition via memory corruption, but the README notes that with further modification, remote code execution (RCE) may be possible. No hardcoded endpoints are present; the user must supply the target's IPv6 address and network interface. The repository consists of two files: the exploit script and a README with usage notes and credits.

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-38063, a Windows TCP/IP remote code execution vulnerability patched by Microsoft in August 2024. The repository consists of a Python script (CVE-2024-38063_PoC.py) and a README.md file. The exploit uses Scapy to craft and send two specific IPv6 packets (one with a Destination Options header and one with a Fragment header) to a target Windows machine's MAC and IPv6 address. The README provides context, usage instructions, and references, including a link to the official Microsoft advisory. The PoC demonstrates the minimal packet sequence required to trigger the vulnerability, but does not include a full exploit for code execution. No hardcoded endpoints are present; the user must supply the target's MAC and IPv6 address. The attack vector is network-based, requiring local network access to send raw Ethernet frames to the target.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-38063, a Windows TCP/IP stack remote code execution vulnerability. The main exploit is implemented in Python (CVE-2024-38063_PoC.py) and leverages the Scapy library to craft and send custom IPv6 packets, including destination options and fragmented packets, to a specified target. The script allows the user to specify the network interface, destination IPv6 address, MAC address, number of tries, batches, and an optional shellcode payload file. If a shellcode file is provided, its contents are included in the payload of the fragmented packets; otherwise, a default payload is used. The exploit attempts to trigger the vulnerability by sending a large number of crafted packets and then checks if the target is still responsive via ICMPv6 ping. The repository also includes a C-language version (c-language/main.c) that performs similar packet crafting and sending, though the README notes it is under development. The exploit is intended for use in controlled environments and requires root privileges. No hardcoded IPs or domains are present, but the default target is the IPv6 loopback address (::1). The repository is structured with clear separation between the Python PoC, C code, and documentation, and is focused on demonstrating the vulnerability rather than providing a weaponized or automated attack tool.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-38063, a critical remote code execution vulnerability in the Windows TCP/IP stack affecting IPv6 packet handling. The main exploit script, 'CVE-2024-38063.py', is a Python tool that allows the user to send specially crafted IPv6 packets (including ICMP and TCP SYN floods with fragmented headers) to a target Windows system, with the goal of triggering a Blue Screen of Death (BSOD). The script supports network interface selection, optional target IPv6 and MAC address specification, and configurable attack parameters. It also integrates with the 'v6disc' tool for IPv6 host discovery and provides real-time traffic analysis, visualization, and automated PDF reporting. The exploit does not currently achieve remote code execution, but demonstrates denial-of-service capability. The repository includes a README with detailed usage instructions, affected product versions, mitigation advice, and references. The code is intended for research and educational purposes only.

This repository contains a Python proof-of-concept exploit for CVE-2024-38063, a memory corruption vulnerability triggered by specially crafted IPv6 packets. The main script, 'cve-2024-38063.py', uses the Scapy library to generate and send batches of IPv6 packets with specific extension headers and fragmentation options. The script supports sending packets over multiple network interfaces and can optionally include Ethernet headers if a destination MAC address is provided. The README provides detailed usage instructions, including required arguments for specifying interfaces, destination IPv6 address, optional MAC address, and the number of tries and batches. The exploit is designed to be run from the command line and is intended to test or trigger the vulnerability on a target system accessible via IPv6. No hardcoded endpoints are present; the user must supply the target IP and (optionally) MAC address. The exploit is a POC and does not include a post-exploitation payload.