Exploit module for BeyondTrust Privileged Remote Access & Remote Support (CVE-2024-12356, CVE-2025-1094)#19877

Merged

msutovsky-r7 merged 19 commits intorapid7:masterfrom sfewer-r7:CVE-2024-12356

Feb 17, 2025

+445

Commits on Jan 31, 2025

Commits on Feb 12, 2025

Commits on Feb 13, 2025

Commits on Feb 14, 2025

Improve the auto discovery of the target site info. We can query an undocumented API endpoint to discover the target site company name.
sfewer-r7
committed

Commits on Feb 17, 2025

Fix typo in comment (Thanks jvoisin)

sfewer-r7
and
jvoisin
authored
Print the actual status code in the error message (Thanks msutovsky-r7)

sfewer-r7
and
msutovsky-r7
authored
Remove a duplicate work in this comment (Thanks jvoisin)

sfewer-r7
and
jvoisin
authored
Explicitly close the WebSocket connection

sfewer-r7
and
msutovsky-r7
authored
Add some comments in the check routine to note theres is no known lower bound version number, and the patch does not change the version number.
sfewer-r7
committed
remove the uneeded parenthesis and make rubocop happy.
sfewer-r7
committed
add in some logic to detect potentially failed exploitation due to the patch being applied, warning a user of a WebSocket getting closed unexpectadly
sfewer-r7
committed
check the frame for nil
sfewer-r7
committed
We can remove this line as it is redundant. The regex that follows will check for the same thing as part of its matching expression. Thanks msutovsky-r7 for spoting this.
sfewer-r7
committed