🔓 CVE-2026-3502 - TrueConf Client Update Hijacking Exploit

⚠️ WARNING

This tool is for educational purposes and authorized testing only. Do not use on systems without explicit permission.

📋 Description

Exploit for CVE-2026-3502 - update vulnerability without integrity verification in TrueConf Client (Windows). It allows an attacker who controls a local TrueConf server to replace the legitimate update package with a malicious one, achieving remote code execution on all connected clients.

🎯 Impact

• Arbitrary code execution in update context (elevated privileges)
• Malware distribution through legitimate channels
• Persistence via Run keys and scheduled tasks
• Privilege escalation via UAC bypass (iscsicpl.exe)
• Havoc C2 deployment (observed in TrueChaos operation)

🔍 CVSS Score

• Score: 7.8 HIGH
• Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
• CWE: CWE-494 (Download of Code Without Integrity Check)
• CISA KEV: Added 02/04/2026, mitigation required before 16/04/2026

🏗️ Attack Architecture

┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐ │ Attacker │────▶│ Compromised │────▶│ TrueConf │ │ Controls │ │ TrueConf Server │ │ Client │ │ Server │ │ (Internal LAN) │ │ Downloads │ └─────────────────┘ └──────────────────┘ │ Malicious EXE │ │ └─────────────────┘ │ │ ▼ ▼ ┌──────────────────┐ ┌─────────────────┐ │ C:\Program │ │ Inno Setup │ │ Files\TrueConf │ │ Installer │ │ Server\Client │ │ Executes │ │ InstFiles\ │ │ with Admin │ └──────────────────┘ └─────────────────┘

📦 Installation

git clone https://github.com/tu-usuario/CVE-2026-3502-TrueConf-RCE-PoC.git
cd CVE-2026-3502-TrueConf-RCE-PoC
pip install -r requirements.txt