CVE-2024-24590 PoC — Allegro 代码问题漏洞

Source

Associated Vulnerability

Description

Created this exploit for the Hack The Box machine, Blurry.

Readme

# ClearML Exploit

This repository contains a proof-of-concept exploit for a deserialization vulnerability in ClearML, allowing for remote command execution. This exploit demonstrates how to upload a malicious pickle artifact to ClearML to gain a reverse shell.

## Prerequisites

Before you begin, ensure you have met the following requirements:

- A machine running ClearML.
- Python 3.8 or higher.
- The `clearml` library installed. You can install it using pip:

  ```bash
  pip install clearml
  clearml-init
  ```

Follow the onscreen instructions and paste your configuration settings when prompted.

Start your listener with:

  ```bash
  nc -lvnp <your_port>
  ```

It might take a minute or so for the server to process the payload, so be patient.

For more information on the vulnerability, click the following link:

https://www.cve.org/CVERecord?id=CVE-2024-24590

File Snapshot

 [4.0K]  /data/pocs/ea983b7ffa62cf77cfc8f38a61c7d9d27167959b
├── [ 860]  exp.py
└── [ 877]  README.md

0 directories, 2 files

Remarks