CVE-2024-1708 和 CVE-2024-1709

由 @watchTowr 开发的概念验证（PoC），利用身份验证绕过漏洞在 ConnectWise ScreenConnect 中添加新的管理用户。这是简单的远程命令执行链的第一步。

关注 watchTowr 实验室团队，获取我们的安全研究

• https://labs.watchtowr.com/
• https://twitter.com/watchtowrcyber
• https://www.bleepingcomputer.com/news/security/connectwise-urges-screenconnect-admins-to-patch-critical-rce-flaw/
• https://www.bleepingcomputer.com/news/security/screenconnect-critical-bug-now-under-attack-as-exploit-code-emerges/
• https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
• Metasploit RCE 模块 - https://github.com/rapid7/metasploit-framework/pull/18870