CVE-2020-16898 PoC — Windows TCP/IP Remote Code Execution Vulnerability

Source

https://github.com/esnet-security/cve-2020-16898

Associated Vulnerability

Title:Windows TCP/IP Remote Code Execution Vulnerability (CVE-2020-16898)
Description:A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.

Description

Detects CVE-2020-16898: "Bad Neighbor"

File Snapshot


 [4.0K]  /data/pocs/794c7423c62341132bbb360dfe1c8dfd2e57dc65
├── [4.0K]  docs
│   ├── [ 259]  CODE_OF_CONDUCT.md
│   ├── [2.9K]  conf.py
│   ├── [2.2K]  contributing.rst
│   ├── [  12]  genindex.rst
│   ├── [ 426]  index.rst
│   ├── [  26]  Makefile
│   ├── [  27]  README.rst
│   ├── [  50]  requirements.txt
│   ├── [4.0K]  sphinxcontrib
│   │   ├── [  57]  __init__.py
│   │   ├── [ 11K]  zeek.py
│   │   └── [4.4K]  zeekygen.py
│   ├── [4.0K]  _static
│   │   └── [ 365]  theme_overrides.css
│   └── [4.0K]  _templates
│       ├── [ 644]  breadcrumbs.html
│       └── [ 238]  layout.html
├── [1.5K]  LICENSE
├── [ 23K]  README.rst
├── [4.0K]  scripts
│   ├── [ 354]  consts.zeek
│   ├── [  67]  __load__.bro
│   ├── [  91]  __load__.zeek
│   ├── [4.0K]  local
│   │   ├── [  67]  __load__.bro
│   │   └── [  41]  __load__.zeek
│   ├── [2.4K]  main.zeek
│   └── [   1]  README
├── [4.0K]  tests
│   ├── [4.0K]  Baseline
│   │   ├── [4.0K]  cve-2020-16898.16898_true_negative
│   │   │   └── [   0]  notice.log
│   │   ├── [4.0K]  cve-2020-16898.16898_true_positive_new
│   │   │   └── [ 774]  notice.log
│   │   └── [4.0K]  cve-2020-16898.16898_true_positive_old
│   │       └── [ 789]  notice.log
│   ├── [1.0K]  btest.cfg
│   ├── [4.0K]  cve-2020-16898
│   │   ├── [ 147]  16898_true_negative.zeek
│   │   ├── [ 159]  16898_true_positive_new.zeek
│   │   ├── [ 158]  16898_true_positive_old.zeek
│   │   ├── [ 460]  bare_mode.zeek
│   │   └── [ 169]  load.zeek
│   ├── [ 718]  Makefile
│   ├── [ 205]  random.seed
│   ├── [4.0K]  Scripts
│   │   ├── [2.0K]  combine-profiler-files
│   │   ├── [ 973]  coverage
│   │   ├── [2.3K]  coverage-calc
│   │   ├── [1.3K]  coverage-to-gcov
│   │   ├── [ 383]  diff-remove-timestamps
│   │   ├── [ 413]  finalizer
│   │   ├── [  98]  get-zeek
│   │   ├── [2.8K]  get-zeek-env
│   │   ├── [ 267]  mock_functions.zeek
│   │   ├── [ 228]  version-gte
│   │   └── [ 227]  version-lt
│   └── [4.0K]  Traces
│       ├── [ 118]  scapy_malicious_rdnss.pcap
│       └── [ 244]  scapy_nonmalicious_rdnss.pcap
└── [ 225]  zkg.meta

14 directories, 48 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!