Unauthenticated SSRF on Havoc C2 teamserver via spoofed demon agent (CVE-2024-4157)

PoC: https://github.com/chebuya/Havoc-C2-SSRF-poc Your browser does not support the video tag. Summary Havoc C2 is a modern and malleable post-exploitation command and control framework targetting windows systems utilized by red teamers and threat actors alike. While auditing the codebase, I was able to discover a vulnerability in which unauthenticated attackers could create a TCP socket on the teamserver with an arbitrary IP/port, and read and write traffic through the socket. By exploiting this vulnerability, attackers could leak the origin IP of a teamserver behind public redirectors (attribution), abuse vulnerable teamservers as a redirector (misattribution) and route traffic through any listening socks proxies on the teamserver.