Skip to content

basic concept for the latest windows wifi driver CVE

Notifications You must be signed in to change notification settings

NTLoner/CVE_2024_30078_POC_WIFI

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 

Repository files navigation

CVE-2024-30078 Exploit

Overview

CVE-2024-30078:

describes a vulnerability in the way Windows handles SSIDs (Service Set Identifiers) in WiFi networks. Windows can manage SSIDs up to 512 bytes long, which exceeds the WiFi standard. By sending chunked frames to increase the SSID size beyond 512 bytes, a buffer overflow can be triggered. This exploit leverages this vulnerability to cause a buffer overflow by creating and sending WiFi beacon frames with oversized SSID fields.

Explanation

How the Code Works

Imports and Initialization:

The script imports necessary modules from Scapy and the system module.

SSID Chunking:

The create_wifi_packet function breaks the provided SSID into chunks of 255 bytes each (the maximum length allowed per chunk).

Frame Creation:

For each chunk, a WiFi beacon frame is created.

The frame includes:

Dot11 header for specifying the frame type and addresses. Dot11Beacon to indicate a beacon frame. Dot11Elt to embed the SSID chunk.

Sending Frames:

Each frame is sent using the sendp function with specific parameters for interface, count, interval, and verbosity.

Error Handling:

The script checks for permission errors and other exceptions during packet sending. Buffer Overflow Mechanism Windows handles SSIDs up to 512 bytes, which is above the WiFi standard. By sending SSID chunks that exceed this limit, a buffer overflow can be triggered in the Windows WiFi handling subsystem. This overflow can potentially allow an attacker to execute arbitrary code or cause a system crash.

Potential Issues and Considerations

Root Privileges:

The script requires root privileges to send packets. Ensure you run the script with sudo.

Interface Availability:

The script assumes the wireless interface is wlan0. Adjust this if your interface has a different name.

Permission and Dependency Errors:

Ensure Scapy and its dependencies are properly installed. Handle permissions for accessing the network interface.

Legal and Ethical Implications:

Using this script to exploit the vulnerability on unauthorized networks is illegal and unethical. Use it only for authorized security testing and research purposes. Disclaimer This code is provided for educational purposes only. The author is not responsible for any damage caused by the misuse of this script. Use responsibly and only in environments where you have explicit permission to perform such testing.

About

basic concept for the latest windows wifi driver CVE

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 100.0%