CVE-2024-21412_Water-Hydra

Deliver malware via CVE-2024-21412

usage

Start the services in order, then access the web server.

webserver

Start a web server in the folder: python -m http.server

• Initial Access: Use Windows Advanced Query Syntax (AQS) to link back to a JPEG trojan hosted on a WebDAV share.
• Initial Access: Use the search: protocol to customize a Windows Explorer window.
  • It uses the search: application protocol to perform a photo search.
  • It uses the crumb parameter to restrict the search scope to the malicious WebDAV share.
  • It uses the DisplayName element to deceive users into thinking it is the local Downloads folder.

samba-compose

Run docker compose up in the folder.

• Samba server using the crazymax/samba Docker image.

loader

Create a2.cmd and compress it into , then place it in the folder.