Havoc-PWN (Authenticated)

This SSRF-RCE Chain was inspired by chebuya's CVE-2024-41570 SSRF POC and IncludeSecurity's Havoc Auth RCE both exploits are amazing and well crafted, please do give these creators appriciation for their hardwork!

• chebuya
• hyperreality

How does it Work?

The SSRF vulnerability works by spoofing a demon agent registration and checkins to open a TCP socket on the teamserver and read/write data from it. The RCE vulnerability works by exploiting a flaw in Havoc's Payload creation by injecting code within the Service-Name, unfiltered string, allowing a Authenticated User to run System Commands on the teamserver.

With a teamserver's websocket port being inaccessible to the public, we can create functions that create WebSocket frames that we can push to the Closed/Filtered Teamserver port via the SSRF.

Consider the Following. . .

• If the Teamserver port is Closed/Filtered, the Teamserver needs to be hosted on a non-secure web-socket server (ws://) for this POC to work. I'm not a networking or TLS protocol expert, but if there is potential to sent data successfully to a secure web-socket server wss:// via the SSRF, this exploit could potentially have a wide impact.
• If the Teamserver port is Open and can be reached publically, you do not need to use the SSRF, if you have working credentials use the Auth-RCE portion of the exploit.

Hackers (1995) - Hack The Planet!