CVE-2024-30088 – WinRM Adapted PoC

📌 Summary

This is a modified version of the original CVE-2024-30088 exploit, adapted to work in non-interactive environments (WinRM).

The original PoC spawns an interactive cmd.exe, which does not work over WinRM. This version focuses on non-interactive execution and stability.

🔧 Changes from Original PoC

• Replaced CREATE_NEW_CONSOLE with CREATE_NO_WINDOW

• Added WaitForSingleObject() to ensure synchronous execution

• Added verbose logging (printf + fflush) for visibility over WinRM

• Removed interactive pauses (getchar)

• Hardcoded execution of external binary:

  root@kitploit:~

  C:\temp\shellz.exe
  

  via PowerShell:

  root@kitploit:~

  powershell.exe -c Start-Process C:\temp\shellz.exe
  

⚙️ Compile

Using Visual Studio (x64):

msbuild poc.sln /p:Configuration=Release /p:Platform=x64

🚀 Usage

Upload the compiled binary and execute via WinRM:

.\poc.exe