CVE-2020-16898 PoC — Microsoft Windows tcp/ip 安全漏洞

Description

A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)

介绍

# "Bad Neighbor" Detection, CVE-2020-16898 (Windows TCP/IP RCE) 

## Summary:  
A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)

## References: 
- https://corelight.blog/2020/10/15/zeek-community-activates-to-detect-bad-neighbor-cve-2020-16898/
- https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16898#ID0EUGAC
- Other detection packages developed independently and concurrently by the Zeek community:
https://github.com/initconf/CVE-2020-16898-Bad-Neighbor/blob/master/scripts/CVE-2020-16898-Bad-Neighbor.zeek  
https://github.com/esnet-security/cve-2020-16898

## Notices raised :   

```CVE-2020-16898 exploit detected from %s. https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16898#ID0EUGAC . Details from packet for reference: info=%s , options=%s```


## Usage, notes and recommendations:
- To use against a pcap you already have ```zeek -Cr scripts/__load__.zeek your.pcap```   
- This package will run in clustered or non clustered environments.  

## Feedback
- As details emerge, we are keen to improve this package for the benefit of the community, please feel free to contact the author with any suggestions and feedback.

文件快照

备注