Sploitus

Exploit for CVE-2020-16898

githubexploit · 2020-10-20

Exploit Code

README37 lines
## https://sploitus.com/exploit?id=60DC34D5-16D7-5E65-8C51-B36123C2EF39
# CVE-2020-16898  
CVE-2020-16898: Windows TCP/IP remote code execution vulnerability (EXP&POC)  

## Reproduction  
forforever: https://www.cnblogs.com/forforever/p/13846077.html  
## POC  

**CVE-2020-16898_Checker-poc**  

**Command:**  
The administrator runs PowerShell/CMD:  
```
Powershell.exe -ExecutionPolicy UnRestricted -File .\CVE-2020-16898-poc.ps1
```  

## exp  

**CVE-2020-16898-exp2**  
Condition: Ability to communicate with the target, and knowledge of the target’s local IPv6 address.  
Usage:  
Modify the `dst` parameter in the code to be the target’s local IPv6 address. Then execute the attack using:  
`python3 CVE-2020-16898.py`  

![image-20201020130144332](images/image-20201020130144332.png)  
![img](images/T[XU6BDGPR287]CGSX4EM5P.png)  

**CVE-2020-16898-exp1.py**  
Requires the target’s “IPv6 address” or “temporary IPv6 address” and your own local IPv6 address.  
Example:  
```
v6_dst = "fd15:4ba5:5a2b:1008:109f:9a46:8d19:f103"  # Modify to the target’s IPv6 address or temporary IPv6 address
v6_src = "fe80::501a:49b7:b7d:5362%12"              # Attacker’s local IPv6 address
```  
However, testing revealed that using the target’s local IPv6 address also works. It’s unclear whether this is due to local testing or if the source IPv6 address can be forged.  
After modification, simply execute:  
`python3 CVE-2020-16898-exp1.py`