CVE-2024-47177

This repository contains a honeypot designed to detect exploitation attempts of CVE-2024-47177, a vulnerability in CUPS that allows remote command execution via the `FoomaticRIPCommandLine` parameter in PPD files. The honeypot monitors incoming print job requests and logs potential exploit attempts.

This repository contains a functional exploit for CVE-2024-47177, targeting a vulnerability in CUPS (Common Unix Printing System). The exploit involves setting up a malicious IPP server and sending a crafted UDP packet to trigger remote code execution via command injection in the printer's attributes.

This Metasploit module exploits multiple CUPS vulnerabilities (CVE-2024-47076, CVE-2024-47175, CVE-2024-47177, CVE-2024-47176) by advertising a malicious printer via mDNS and IPP, achieving remote code execution when a victim sends a print job. The exploit leverages CUPS' default configuration on Linux systems and executes payloads in the context of the 'lp' user.