fevar54/cve-2026-3502---trueconf-client-update-hijacking-pocPoC de CVE-2026-3502: hijacking de actualizacion en TrueConf Client para RCE (Operacion TrueChaos).
This tool is for educational purposes and authorized testing only. Do not use on systems without explicit permission.
Exploit for CVE-2026-3502 - update vulnerability without integrity verification in TrueConf Client (Windows). It allows an attacker who controls a local TrueConf server to replace the legitimate update package with a malicious one, achieving remote code execution on all connected clients.
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────┐ │ Attacker │────▶│ Compromised │────▶│ TrueConf │ │ Controls │ │ TrueConf Server │ │ Client │ │ Server │ │ (Internal LAN) │ │ Downloads │ └─────────────────┘ └──────────────────┘ │ Malicious EXE │ │ └─────────────────┘ │ │ ▼ ▼ ┌──────────────────┐ ┌─────────────────┐ │ C:\Program │ │ Inno Setup │ │ Files\TrueConf │ │ Installer │ │ Server\Client │ │ Executes │ │ InstFiles\ │ │ with Admin │ └──────────────────┘ └─────────────────┘
git clone https://github.com/tu-usuario/CVE-2026-3502-TrueConf-RCE-PoC.git
cd CVE-2026-3502-TrueConf-RCE-PoC
pip install -r requirements.txt