Sploitus

Exploit for CVE-2020-16898

githubexploit · 2020-10-28

Exploit Code

README55 lines
## https://sploitus.com/exploit?id=803A4C79-0547-5178-A113-233AC5D2498C
# CVE-2020-16898

CVE-2020-16898: Windows TCP/IP remote code execution vulnerability (EXP & POC)

## Reproduction

Source: https://www.cnblogs.com/forforever/p/13846077.html

## POC

**CVE-2020-16898_Checker_poc**

**Command:**

The administrator runs PowerShell/CMD:

```
PowerShell.exe -ExecutionPolicy UnRestricted -File "\CVE-2020-16898_poc.ps1"
```

**EXP**

**CVE-2020-16898-exp2**

Conditions: Ability to communicate with the target, knowledge of the target’s local link IPv6 address.

**Usage:**

Modify the `dst` parameter in the code to the target’s local link IPv6 address. Then execute the attack using the following command:

```
python3 CVE-2020-16898.py
```

![Image-20201020130144332](images/image-20201020130144332.png)

![Image](images/T[XU6BDGPR287]CGSX4EM5P.png)

**CVE-2020-16898-exp1.py**

Required: The target’s “ipv6 address” or “temporary ipv6 address” and your own local link IPv6 address.

```
v6_dst = "fd15:4ba5:5a2b:1008:109f:9a46:8d19:f103"  # Modify to the target’s ipv6 address or temporary ipv6 address
v6_src = "fe80::501a:49b7:b7d:5362%12"              # Attacker’s local ipv6 address
```

However, testing revealed that it is also possible to use the target’s local link ipv6 address. It’s unclear whether this is due to local testing or if the source IPv6 address can be forged.

After modification, simply execute:

```
python3 CVE-2020-16898-exp1.py
```