CVE-2024-28987

Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Overview

• Extracts up to 25 most recent tickets (API limitation)
• Retrieves full details for each ticket
• Analyzes ticket IDs to estimate total tickets in system
• Organizes output in a structured directory format

Reasoning

This builds on other exploits for this vuln. Other exploits (like MSFconsole) would trunkate output, and I wanted to see the entirety of ALL tickets.

Usage

python3 solar_exploit.py -u https://target.com [-o output_directory] [-d delay_seconds]

Legal Disclaimer

This tool is provided for EDUCATIONAL PURPOSES ONLY. The author accepts no liability for any misuse of this software. Users must:

Only use against systems they own or have explicit written permission to test Follow all applicable laws and regulations Understand that unauthorized access to computer systems is illegal

By using this tool, you take full responsibility for your actions. The author cannot be held responsible for any damages resulting from its use.