certcc / poc-exploits

Select proof-of-concept exploits for software vulnerabilities to aid in identifying and testing vulnerable systems.

PoC-Exploits

Select proof-of-concept exploits and intrusion detection rules for software vulnerabilities to help in identifying, testing and mitigating vulnerable systems.

The PoC is organized by CVE or by VU# when multiple inter-related CVE are published by CERT/CC under one VU#

poc-exploits's Issues

share malformed_dns.pcap

Hello @sei-vsarvepalli
Would it be possible to share the pcap you used for testing?
Thanks

Don't use .dmp for pcap files

It's probably best to use a file extension that reflects what type of file is being used.
https://github.com/CERTCC/PoC-Exploits/tree/master/cve-2020-1472
has several .DMP files, but .DMP isn't commonly associated with Wireshark.

If it's a pcap file, then .pcap seems like a more appropriate extension.

raise IndexError("Layer [%s] not found" % lname)

Hello,

I am getting the following error when running your program:

Initiating communications with PPTP server 192.168.8.1 Traceback (most recent call last): File "/home/kali/Project/./pptp_poc.py", line 96, in <module> call_reply = PPTPOutgoingCallReply(call_reply) File "/usr/lib/python3/dist-packages/scapy/base_classes.py", line 266, in __call__ i.__init__(*args, **kargs) File "/usr/lib/python3/dist-packages/scapy/packet.py", line 158, in __init__ self.dissect(_pkt) File "/usr/lib/python3/dist-packages/scapy/packet.py", line 875, in dissect s = self.do_dissect(s) File "/usr/lib/python3/dist-packages/scapy/packet.py", line 839, in do_dissect s, fval = f.getfield(self, s) File "/usr/lib/python3/dist-packages/scapy/fields.py", line 163, in getfield return s[self.sz:], self.m2i(pkt, self.struct.unpack(s[:self.sz])[0]) File "/usr/lib/python3/dist-packages/scapy/packet.py", line 1185, in __getitem__ raise IndexError("Layer [%s] not found" % lname)
Here is a link to the pcap file when I run against my pptp server:
https://drive.google.com/file/d/14D3PgPk839ug_PXKhWLYS-qQDVAyQJ73/view?usp=sharing

Any help would be greatly appreciated!

sid:1371257161 error

Using the rules from https://github.com/CERTCC/PoC-Exploits/tree/master/vu-257161 I get this error:

<Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Signature combines packet specific matches (like dsize, flags, ttl) with stream / state matching by matching on app layer proto (like using http_* keywords).
<Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert dns any any -> any any (msg:"VU#257161:CVE-2020-11901 DNS malformed response to provide incorrect size for heap allocation error"; dsize:>128 ; app-layer-event:dns.malformed_data; sid:1371257161; rev:1;)" from file /path/to/custom.rules at line 26

I'm using suricata 5.0.2 (pfsense package).