## https://sploitus.com/exploit?id=94FC8355-2B11-5685-8540-91CA4BEC5E74
# 🛡️ Vulnerability and Exploit Analysis
> Ethical Hacking laboratory analyzing CVEs, exploits, CVSS severity, and vulnerability prioritization.
---
## 📖 Overview
This repository contains **Assignment 2 — Lab Exercise: Understanding Vulnerabilities and Exploits** for the **Ethical Hacking** subject.
The activity focuses on researching real-world vulnerabilities, examining publicly available exploits, understanding the Common Vulnerability Scoring System (CVSS), and learning how security professionals prioritize vulnerabilities based on severity and real-world risk.
---
## 🎯 Objectives
This laboratory activity aims to:
- Research and analyze Common Vulnerabilities and Exposures (CVE) entries.
- Identify vulnerability types and potential security impacts.
- Determine whether vulnerabilities have been exploited in the wild.
- Explore publicly available exploit information.
- Understand different types of exploits and attacker gains.
- Deconstruct a CVSS vector string.
- Understand how CVSS scores are used for vulnerability prioritization.
- Identify factors beyond CVSS that influence security decisions.
---
## 🔍 Part 1 — CVE Research
Three vulnerabilities were researched and analyzed:
| CVE | CVSS Score | Severity |
|---|---:|---|
| **CVE-2024-38063** | 9.8 | Critical |
| **CVE-2024-38077** | 9.8 | Critical |
| **CVE-2024-43491** | 9.8 | Critical |
The research examined:
- Vulnerability type
- Potential impact
- Confidentiality
- Integrity
- Availability
- Exploitation status
The selected vulnerabilities include memory corruption issues, a Remote Desktop Licensing Service vulnerability, and a Windows Update rollback vulnerability. :contentReference[oaicite:1]{index=1}
---
## 💥 Part 2 — Exploring the Exploit Database
The activity explored publicly available exploit information associated with the researched CVEs.
The analysis considered:
- Whether a public exploit is available
- Target platforms
- Exploit type
- Potential attacker gains
- Proof-of-Concept (PoC) availability
- Remote exploitation characteristics
For example, **CVE-2024-38063** was analyzed as a remote, zero-click vulnerability capable of leading to Remote Code Execution (RCE), while CVE-2024-38077 was examined in relation to the Remote Desktop Licensing service. :contentReference[oaicite:2]{index=2}
---
## 📊 Part 3 — Understanding CVSS Scoring
The activity included a breakdown of the **CVSS v3.1 vector string** for CVE-2024-38063:
```text
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H