CVE-2024-0670 – Local Privilege Escalation in CheckMK Agent (PowerShell PoC)

Abstract

This repository presents an independent PowerShell proof of concept for CVE-2024-0670, a Windows local privilege escalation vulnerability in the CheckMK Agent. The vulnerability allows a low-privileged local user to escalate to NT AUTHORITY\SYSTEM by exploiting predictable command file execution during an MSI repair process.

This implementation is a derivative analysis of the publicly available PoC by elsevar11 at CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit; it reuses core concepts while offering a streamlined exploitation logic.

Original reference:
https://github.com/elsevar11/CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit/blob/main/exploit.ps1

Vulnerability Summary

• Vendor: Tribe29 / CheckMK
• CVE: CVE-2024-0670
• Severity: High (CVSS 8.8)
• Type: Local Privilege Escalation
• Root Cause: Uncontrolled search path in MSI repair with attacker-controlled files.

During MSI repair, the installer executes files in C:\Windows\Temp with predictable names. An unprivileged user can pre-seed controlled payloads that will subsequently be executed with elevated privileges.

Contents

Requirements

• Windows machine with CheckMK Windows Agent installed
• Unprivileged local user account
• PowerShell (Execution Policy permitting script execution)
• Ability to write to C:\Windows\Temp\
• Reverse shell listener (optional, for payloads)

Configuration (exploit.ps1)

Adjust the following parameters as needed:

$LHOST  # Attacker IP
$LPORT  # Attacker port
$NcPath # Path to payload (e.g., nc.exe)
$MinPID # Lower bound for file seeding
$MaxPID # Upper bound for file seeding

Usage

1. Start a listener on your attacking host:

nc -lvnp <PORT>

2. Run the exploit from a low-privileged account:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\exploit.ps1

SYSTEM shell will be spawned back to your listener if exploitation is successful.

Attribution

The exploitation approach — enumerating MSI packages, seeding predictable filenames, and invoking an MSI repair — is informed by the PoC originally published by elsevar11 on GitHub. This repository adapts that logic into an alternate PowerShell formulation for clarity and research reproducibility.

Legal Notice

This code is provided solely for educational, defensive engineering, and authorized testing. Use against systems without explicit permission is unlawful. The author assumes no responsibility for misuse or legal consequences. License

This repository is released under the MIT License.