## https://sploitus.com/exploit?id=CECEA936-BF62-5770-9B44-B4BE3A3A5890
# CVE-2024-49113 โ LDAP Nightmare
**Windows LDAP Client Remote Code Execution (Heap-Based Buffer Overflow)**
| Field | Value |
|-------|-------|
| **CVE** | CVE-2024-49113 |
| **Alias** | LDAP Nightmare |
| **CVSS 3.1** | 9.8 โ CRITICAL |
| **CWE** | CWE-122 โ Heap-based Buffer Overflow |
| **Discovered** | SafeBreach (published PoC January 2025) |
| **Exploitation** | Active exploitation in the wild confirmed |
| **Patch** | Microsoft December 2024 Patch Tuesday (KB5048685 / KB5048652) |
---
## 1. Overview
CVE-2024-49113 is a **critical heap-based buffer overflow** vulnerability in the **Windows LDAP client library** (`wldap32.dll`). An unauthenticated, remote attacker can trigger the vulnerability by sending a **specially crafted LDAP response** to a victim Windows machine that issues an LDAP query (e.g., a domain controller performing directory lookups).
Because Windows domain controllers routinely send LDAP queries to other domain controllers, member servers, and global catalog servers, this flaw is especially dangerous in Active Directory environments. Successful exploitation achieves **remote code execution** in the context of the **Local System account** (on domain controllers), giving the attacker full control of the targeted server.
The public proof-of-concept (dubbed "LDAP Nightmare") was released by **SafeBreach** in January 2025 after Microsoft shipped fixes in the **December 2024 Patch Tuesday**.
---
## 2. Technical Details
### Root Cause
The vulnerability resides in `wldap32.dll` โ the Windows implementation of the Lightweight Directory Access Protocol (LDAP) client as defined in **RFC 4511**.
When an LDAP client receives a **Search Result Entry** response, the library parses the LDAP message's Protocol Data Units (PDUs) in a BER (Basic Encoding Rules) decoder loop. A flaw in the heap memory allocation logic during the parsing of **LDAP attribute values** causes the decoder to write data **beyond the bounds of a heap-allocated buffer**.
Specifically:
1. The BER decoder reads the **length** field of an LDAP attribute value.
2. A heap buffer is allocated based on this length.
3. During decoding (especially when handling **constructed strings** or **multi-byte** encodings), the decoder **does not correctly track the offset** into the buffer.
4. This leads to a **controlled heap overflow** of up to several kilobytes.
### Trigger Conditions
- The victim must **initiate** an LDAP query (bind + search request).
- The attacker's malicious LDAP server sends a crafted **Search Result Entry (LDAP_RES_SEARCH_ENTRY)** response.
- The overflow occurs **before** any application-level validation of the response data.
- No authentication is required โ the overflow can be triggered during an anonymous LDAP bind.
### Impact
- **Confidentiality**: Complete compromise of all data on the system.
- **Integrity**: Full write capability; attacker can install programs, modify data, create accounts.
- **Availability**: Full control over the target; can deny service.
- **Persistence**: RCE as SYSTEM on domain controllers enables lateral movement across the entire domain.
---
## 3. Affected Versions
All supported editions of **Windows Server** and **Windows Client** are vulnerable **prior to the December 10, 2024 security updates**:
### Windows Server (Domain Controllers โ highest risk)
- Windows Server 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1
### Windows Client (less likely to trigger, but still vulnerable)
- Windows 11 24H2 / 23H2 / 22H2 / 21H2
- Windows 10 22H2 / 21H2
The December 2024 Patch Tuesday updates that address this CVE are:
- **KB5048685** โ Windows Server 2025 / Windows 11 24H2
- **KB5048652** โ Windows Server 2022 / Windows 11 23H2
- **KB5048661** โ Windows 10 22H2
- And equivalent updates for other versions (see [MSRC advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49113)).
---
## 4. Reproduction Steps
### Architecture
```
โโโโโโโโโโโโโโโโโโโโ LDAP Query โโโโโโโโโโโโโโโโโโโโโโโ
โ Victim Host โ โโโโโโโโโโโโโโโโโโโโโโโโโโโถ โ Attacker LDAP โ
โ (Windows DC) โ โ Server (This PoC) โ
โ โ โโโโโโโโโโโโโโโโโโโโโโโโโโโ โ โ
โ wldap32.dll โ Crafted LDAP Response โ exploit.py โ
โ overflowed โ (heap overflow payload) โ port 389 โ
โโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโโโโโโโโโ
```
### Prerequisites
- A **Windows domain controller** (or Windows host configured to query LDAP) **without** December 2024 patches.
- **Python 3.8+** on the attacker machine (can be Windows, Linux, or macOS).
- **Network connectivity** from the victim to the attacker on **TCP port 389**.
- For non-domain-joined victims, you may need to configure the host to point to the attacker as its LDAP server (e.g., via hosts file or DNS).
### Step-by-Step
#### 1. Verify the Target is Unpatched
On the victim, check the installed KBs:
```powershell
Get-HotFix | Where-Object { $_.HotFixID -match "KB5048685|KB5048652" }
```
If no results are returned, the system is **unpatched and vulnerable**.
#### 2. Start the Malicious LDAP Server
On the attacker machine, run this PoC:
```bash
python exploit.py --listen-ip 192.168.1.100 --listen-port 389
```
Where `192.168.1.100` is the attacker's IP address.
**Note:** On Linux, binding to port 389 requires root (`sudo`). On Windows, admin privileges may be required.
#### 3. Trigger an LDAP Query from the Victim
From the victim machine (PowerShell, as Administrator):
```powershell
# Force an LDAP search against the attacker server
$ldapPath = "LDAP://192.168.1.100/DC=evil,DC=local"
$searcher = New-Object DirectoryServices.DirectorySearcher($ldapPath)
$searcher.Filter = "(objectClass=*)"
$searcher.SearchRoot = $null
try {
$results = $searcher.FindAll()
} catch {
Write-Host "Connection attempted โ check the PoC server for crash details"
}
```
Alternatively, use `ldp.exe` (included with Windows Server / RSAT):
1. Open **ldp.exe**
2. Connection โ Connect โ Enter attacker IP, port 389
3. Connection โ Bind โ (leave blank for anonymous)
4. View โ Tree โ Base DN: `DC=evil,DC=local`
5. Click **Run**
#### 4. Observe the Overflow
- The PoC server will print `[*] Sending malicious search result entry...` and send the crafted response.
- If successful, the victim's `lsass.exe` or the LDAP client process will **crash** with an access violation (0xC0000005), or the system may **BSOD**.
- For actual RCE, the heap layout must be groomed and the overflow controlled โ the PoC included here demonstrates the **crash primitive** (denial of service) as a starting point.
### Docker-Based Reproduction (Alternative)
A Dockerfile is provided to run the PoC in an isolated environment:
```bash
docker build -t ldap-nightmare .
docker run --rm -p 389:389 --cap-add=NET_ADMIN ldap-nightmare
```
---
## 5. Proof of Concept (exploit.py)
The included `exploit.py` implements:
- **LDAP bind response** โ accepts anonymous or simple binds.
- **Crafted Search Result Entry** โ delivers the heap overflow payload.
- **Threaded connection handler** โ handles multiple victim connections.
- **Configurable** via command-line arguments (`--listen-ip`, `--listen-port`, `--payload-size`).
### Payload Structure
| Offset | Field | Value |
|--------|-------|-------|
| 0x00 | LDAP Message Tag (0x30) | Sequence |
| 0x01โ0x02 | Total Length (crafted) | Large value triggers overflow |
| 0x03 | ProtocolOp (0x64) | Search Result Entry |
| 0x04โ0x0E | LDAP Result Fields | Standard header |
| 0x0F+ | Attribute List | Overflow trigger (length = 0xFFFF) |
### Running Against a Lab Target
```bash
# Start the malicious server
sudo python exploit.py --listen-ip 0.0.0.0 --listen-port 389
# In another terminal, watch for connections
tcpdump -i any port 389 -X
```
---
## 6. Mitigation
### Patch
Install the **December 10, 2024 Patch Tuesday** updates:
- **Windows Update**: Check for updates and install the December 2024 cumulative update.
- **WSUS / SCCM**: Approve and deploy KB5048685 / KB5048652 / KB5048661 (version-dependent).
- **Microsoft Catalog**: Download standalone packages from [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/).
### Workarounds (if patching is delayed)
If the patch cannot be applied immediately:
1. **Network Segmentation** โ Block LDAP (TCP 389 / 636) traffic from untrusted networks to domain controllers.
2. **Disable Anonymous LDAP Queries** โ On domain controllers, restrict anonymous access:
```powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" `
-Name "LDAPServerIntegrity" -Value 2 -Type DWord
Restart-Service NTDS
```
3. **Monitor for LDAP Crashes** โ Enable auditing for LDAP client crashes:
```powershell
wevtutil qe "Windows PowerShell" /f:text /q:"*[System[EventID=1000]]"
```
---
## 7. References
| Source | URL |
|--------|-----|
| Microsoft Security Response Center | [MSRC CVE-2024-49113](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49113) |
| SafeBreach (Original Discovery) | [SafeBreach Blog โ LDAP Nightmare](https://www.safebreach.com/blog/ldap-nightmare-cve-2024-49113/) |
| NVD | [NVD CVE-2024-49113](https://nvd.nist.gov/vuln/detail/CVE-2024-49113) |
| CWE-122 | [Heap-based Buffer Overflow](https://cwe.mitre.org/data/definitions/122.html) |
| RFC 4511 | [LDAPv3 Protocol](https://datatracker.ietf.org/doc/html/rfc4511) |
| December 2024 Patch Tuesday | [Microsoft Release Notes](https://support.microsoft.com/en-us/topic/december-10-2024-security-updates) |
---
## 8. Legal Disclaimer
> **This material is provided for educational and authorized security testing purposes only.** Unauthorized exploitation of CVE-2024-49113 against systems without explicit permission is illegal. The authors are not responsible for any misuse of this information. Always obtain written authorization before testing any system.
---