Windows LDAP Remote Code Execution Vulnerability

This repository provides a proof-of-concept exploit for CVE-2024-49112, a critical vulnerability in the Windows LDAP client that can be triggered remotely to crash Windows Server systems. The exploit is implemented in Python and consists of several components: - `LdapNightmare.py`: The main entry point. It parses command-line arguments, starts a malicious LDAP server (on a configurable UDP port, default 389), and then triggers the target to connect to this server by invoking the Netlogon Remote Protocol (NRPC) DsrGetDcNameEx2 RPC call against the target Windows Server. - `exploit_server.py`: Implements the malicious LDAP server using asyncio and ldaptor. When the victim connects, it sends a specially crafted LDAP referral response (with a referral to 'ldap://referral.com'), which is designed to trigger the vulnerability. - `rpc_call.py`: Handles the NRPC DsrGetDcNameEx2 call using impacket, which is used to force the target to connect to the attacker's LDAP server. - `logger.py`: Provides logging functionality. - `requirements.txt`: Lists dependencies (ldaptor, impacket). - `Readme.md`: Contains detailed setup and usage instructions, including the need for the attacker to control a domain with specific DNS SRV records pointing to the attacker's LDAP server. The exploit requires the attacker to control DNS SRV records for a domain and to run a malicious LDAP server. The attack vector is network-based, targeting Windows Server systems with accessible Netlogon and LDAP services. The exploit's main effect is to crash the target system, demonstrating the vulnerability. No weaponized or post-exploitation payload is included; the exploit is a proof-of-concept for denial of service.