Re:Zero-click Windows TCP/IP RCE impacts all systems with IP...
by HereIGoAgain on Friday August 16, 2024 @10:09AM
(#41266592)
For the sake of this issue here, does it matter which is used i wonder, because I have been unable to find any source willing to spell it out. (that is, is simply turning it off on the adapter enough)
Re:Zero-click Windows TCP/IP RCE impacts all systems with IP...
by ndriscoll on Friday August 16, 2024 @03:10PM
(#41269408)
If you mean something like HTTP server logs, then clients should be rotating their addresses regularly, and router firewalls should be blocking any incoming unestablished connections, so you can't just look at a log to find vulnerable computers to talk to.
You'd be much more likely to find a vulnerable computer that you can actually talk to by looking at AAAA records for websites. Or if you were a malicious website, wait for people to talk to you, and then send evil responses.
All somebody has to do is grep "::" some logs somewhere for millions of hosts then | uniq to remove dupliaces > to some file and then there's their master host list.
for all we know, bad actors could be positioning themselves right now. But for hosts that need ipv6 and have no ipv4 uplinks it's not like they can just disable their internet. They can, but they won't.
Cisco just laid off a major amount of their workforce too so, so should be interesting to watch.
Disable IPv6 on All Network Adapters
Get-NetAdapter | ForEach-Object { Disable-NetAdapterBinding -Name $_.Name -ComponentID ms_tcpip6 -PassThru } Disable IPv6 GloballyIf you want to disable IPv6 globally (not just on network adapters), you can use the Windows Registry to achieve this. Here’s how:
# Disable IPv6 on all network interfaces Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters' -Name 'DisabledComponents' -Value 0xFF# Apply the changes by restarting the network interface or rebooting the system Restart-NetAdapter -Name (Get-NetAdapter | Select-Object -First 1).Name
Explanation:
Verify IPv6 StatusTo check if IPv6 has been disabled, you can run:
Get-NetAdapterBinding -ComponentID ms_tcpip6
This command will list network adapters and show whether the IPv6 binding is enabled or disabled. Re-enable IPv6
If you want to re-enable IPv6, you can run:
Get-NetAdapter | ForEach-Object { Enable-NetAdapterBinding -Name $_.Name -ComponentID ms_tcpip6 -PassThru }
Important Notes
By following these steps, you can disable IPv6 on your Windows system using PowerShell.