machevalia/CVE-2024-0692-SolarWinds-SEM-RCE

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python exploit for CVE-2024-0692 that targets SolarWinds Security Event Manager via AMF deserialization. It generates a malicious Java class for a reverse shell, hosts it on an HTTP server, constructs a C3P0 WrapperConnectionPoolDataSource AMF payload, sends it to the target, and provides an interactive shell handler.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single Python script (CVE-2024-0692.py) and a README. The script implements a publicly documented exploit for CVE-2024-0692, a SolarWinds SEM AMF deserialization RCE. It generates a reverse shell payload, hosts it via HTTP, sends the AMF exploit, and provides an interactive shell handler. All behavior is consistent with the stated exploit purpose. No concealed backdoor, unrelated remote access, persistence, credential theft, or deceptive payload targeting the person running the PoC was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPythonJava
Target softwareSolarWinds Security Event Manager
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete, self-contained exploit script that generates and delivers a deserialization payload to achieve remote code execution and provides an interactive reverse shell handler. It does not merely detect or report a vulnerability; it actively exploits it.

CVE-2024-0692.py:1-550

Requirements

  • Java 8+ JDK (javac) to compile the malicious payload classCVE-2024-0692.py:15
  • Python 3.6+ with requests libraryCVE-2024-0692.py:16-17
  • Network connectivity from attacker to target and from target back to attacker's HTTP server and reverse shell listenerCVE-2024-0692.py:12

Observed behavior

  • Compiles a Java class containing a reverse shell payload (bash and PowerShell variants)CVE-2024-0692.py:171-228
  • Starts an HTTP server to serve the compiled malicious class to the targetCVE-2024-0692.py:340-351
  • Generates an AMF3 deserialization payload using the C3P0 WrapperConnectionPoolDataSource gadget chainCVE-2024-0692.py:231-252
  • Sends the AMF payload via HTTP POST to the target's /services/messagebroker/streamingamf endpointCVE-2024-0692.py:354-390
  • Listens for and provides an interactive reverse shell sessionCVE-2024-0692.py:58-168
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Listener
ReverseShellListener class binds to 0.0.0.0 on user-specified port and provides interactive shellThis is the intended exploit behavior: receiving a reverse shell from the target after successful exploitation.CVE-2024-0692.py:58-168
Java Payload Generation
create_java_payload_class generates a Java class that executes a reverse shell to the attacker's host/portStandard reverse shell payload for RCE exploitation; no hidden or unrelated commands.CVE-2024-0692.py:171-228
Http Server
ExploitHTTPHandler serves the generated .class file to the target for remote class loadingRequired for the C3P0 deserialization gadget to load the malicious class; serves only the expected class file.CVE-2024-0692.py:315-351
Amf Payload Construction
Functions build_c3p0_hex_payload, build_jndi_reference_hex, encode_amf3_string_hex, wrap_amf_envelope construct the AMF deserialization payloadImplements the documented CVE-2024-0692 exploit technique; no extraneous payload data.CVE-2024-0692.py:231-293
Author Contact
machevalia@SprocketSecurityAuthor identification in comments and banner; not a backdoor indicator.CVE-2024-0692.py:9CVE-2024-0692.py:416
Review boundaries

What the analysis did not establish

  • The evidence is limited to the source code of the exploit script and a README; no execution or runtime behavior was observed.
  • The C3P0 payload generation function (build_c3p0_hex_payload) appears incomplete or simplified, as it uses a hardcoded JNDI Reference hex template that does not incorporate the provided codebase_url and classname, which may affect reliability.
  • The exploit requires the target to be able to reach the attacker's HTTP server to load the malicious class, which may not be possible in all network configurations.
  • Only the two text files (CVE-2024-0692.py and README.md) were reviewed; no binary files were present in the evidence.
  • The review does not assess whether the exploit works as claimed or is safe to execute against authorized targets.
  • The Java payload is generated at runtime and compiled locally; its content is determined by user-supplied arguments and is not reviewed as a static artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1