## https://sploitus.com/exploit?id=8124CEFC-E02F-5BB8-95E3-801916007113
# CVE-2024-1709 — ScreenConnect exploit chain
Full exploit chain for ConnectWise ScreenConnect on-prem instances: wizard auth bypass → extension RCE → root shell.
```
python3 supershell.py -t http://1.2.3.4:8040
```
---
## How it works
The tool chains several techniques in sequence to go from zero to root on a ScreenConnect server.
**Recon.** Fingerprints the version and OS, then checks the wizard endpoint to determine which attack path applies.
**Auth.** Three paths tried in order:
- Direct credential login (if credentials are known)
- MachineKey HMAC-SHA256 cookie forge — bypasses password entirely, requires the `validationKey` from `web.config`
- Wizard bypass (see below)
**RCE.** Uploads a compiled C# ASHX handler as a ScreenConnect extension via `ExtensionService.ashx/InstallExtension`, then calls it through `/App_Extensions/{guid}/Service.ashx` to run arbitrary commands as the service account (typically root on Linux).
**Persistence.** SSH public key injection into `/root/.ssh/authorized_keys` and `/usr/share/locale/.cache` (locked with `chattr +i`), or full deployment via a custom script.
---
## The wizard bypass (CVE-2024-1709)
CVSS 10.0. The setup wizard at `/SetupWizard.aspx/` (trailing slash) is accessible without authentication when no admin accounts exist. The trailing slash causes ASP.NET to skip the authentication check on that route. Patched in SC 23.9.8.
In practice: two POST steps (credentials → license), four license variants tried until one goes through.
---
## Targets that look vulnerable but aren't
This is where most false positives happen. The scope check returns `vuln` (wizard reachable, VIEWSTATE present) in two very different situations:
**Genuinely vulnerable.** No admin accounts exist, wizard is open. The bypass creates an account, the SC service restarts (takes ~60s on Mono/Linux), login succeeds.
**SC 6.x with existing accounts.** On old 6.x builds, the wizard page loads and returns a VIEWSTATE even when accounts already exist. The scope check flags it as `vuln`, the bypass POST goes through, but the login fails because the service restarts and the freshly created account either doesn't persist or is rejected. The instance *looks* vulnerable to CVE-2024-1709 but the wizard is functionally locked. Use known credentials directly (`-u admin -p pass`) or the cookie forge if you have the key.
**Wizard completed (302 redirect).** The wizard has already been run. `SetupWizard.aspx/` redirects to `/Login`. Two fallback techniques are attempted: a path-normalisation bypass on `PageService.ashx/UpdateSetupWizard/%2e/` (works on SC 23.x–25.4 even with accounts) and a direct POST on the wizard (some versions process it without the zero-admin check).
**Patched (404).** The endpoint was removed by the vendor patch. The `PageService.ashx` bypass is still attempted since it hits a different route. If both fail, credentials or the `validationKey` are required.
---
## Usage
```
# scope check — no exploitation, explains what's available
python3 supershell.py -t http://1.2.3.4:8040 --check
# full interactive chain
python3 supershell.py -t http://1.2.3.4:8040
# with known credentials
python3 supershell.py -t http://1.2.3.4:8040 -u admin -p 'password'
# with MachineKey (no password needed)
python3 supershell.py -t http://1.2.3.4:8040 -k AABB00CCDD...
# run a single command
python3 supershell.py -t http://1.2.3.4:8040 --cmd 'cat /etc/passwd'
# interactive shell
python3 supershell.py -t http://1.2.3.4:8040 --shell
# non-interactive (scripting / CI)
python3 supershell.py -t http://1.2.3.4:8040 --yes --skip-deploy
```
---
## MachineKey cookie forge
If the `validationKey` is available (via LFI, backup file, exposed `web.config`, etc.), the `.MONOAUTH` session cookie can be forged without knowing the password. The format is `base64(HMAC-SHA256(key, plaintext))` where the plaintext encodes the membership provider name, the username, and 31 fixed session bytes extracted from a live cookie.
The tool tries a list of common usernames in order. If the server returns `R=6`, the key is wrong and all remaining usernames are skipped.
---
## Requirements
```
pip install curl-cffi
```
Python 3.8+. No other dependencies.