mauzy0x00/velociraptor_cve-2025-6264_pocProof-of-concept exploit for CVE-2025-6264 in Velociraptor, demonstrating privilege escalation via missing permission checks to redirect clients to a malicious server for endpoint takeover.
DISCLAIMER: This is an educational research project. I did not discover this vulnerability. This repository demonstrates CVE-2025-6264 for learning purposes
The Admin.Client.UpdateClientConfig artifact is missing permission checks. Users with the Investigator role (who have COLLECT_CLIENT permission) can use it to update client configs when they shouldn't be able to. This lets you redirect clients to your own malicious Velociraptor server and take over endpoints.
Full writeup on my blog: https://blog.mauzy.net/technology/rapid7-velociraptor-exploit-poc/
This script is meant to aid in the exploitation of this CVE. It does so by doing the following:
The output client configuration is in YAML format and is meant to be inserted into the vulnerable Admin.Client.UpdateClientConfig artifact using a lesser privileged user.
After running the script, the attacker's malicious server is listening for the clients to connect. Once the UpdateClientConfig is run, the clients will rekey and connect to the your server instead of the legitimate one.
How to use:
chmod +x 2025-6264_setup.sh
sudo ./2025-6264_setup.sh
If velociraptor is already installed on your system you can generate a configuration file:
./2025-6264_setup.sh --client-only
To uninstall Velociraptor:
sudo apt autoremove velociraptor-server