foxoman/cve-2024-24576-poc---nimProof-of-concept demonstrating command injection (BatBadBut) vulnerability in Nim on Windows, with payload testing across execProcess and execShellCmd functions.
Exploring Command Injection Vulnerabilities in Windows with Nim
Here's a summarized table based on the testing results from the Nim code experiments with different payloads:
| Payload | execProcess_NoQuoteShell | execProcess_QuoteShell | execShellCmd |
|---|
nim &calc | Not Passed | Not Passed | Passed |
nim" &calc | Passed | Not Passed | Not Passed |
%CMDCMDLINE:~-1%&calc | Passed | Passed | Passed |
"Passed" indicates the payload executed in a way that could potentially exploit the BatBadBut vulnerability, demonstrating the nuanced behavior of command execution methods in Nim in response to different types of inputs.
