Description
An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating from the team server.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 6 repositories
-
chebuya/Havoc-C2-SSRF-poc ★ 75 · Jul 13, 2024
CVE-2024-41570: Havoc C2 0.7 Teamserver SSRF exploit
-
HimmeL-Byte/CVE-2024-41570-SSRF-RCE ★ 16 · Jan 19, 2025
Havoc SSRF to RCE
-
diemoeve/CVE-2024-41570 ★ 11 · Jan 21, 2025
Automated Reverse Shell Exploit via WebSocket | Havoc-C2-SSRF with RCE
-
sebr-dev/Havoc-C2-SSRF-to-RCE ★ 7 · Jan 21, 2025
This is a modified version of the CVE-2024-41570 SSRF PoC from @chebuya chained with the auth RCE exploit from @hyperreality. This exploit executes code remotely to a target due to multiple vulnerabi…
-
leo-mitch/CVE-2024-41570-Havoc-C2-RCE ★ 3 · Jan 19, 2025
This is a Chained RCE in the Havoc C2 framework using github.com/chebuya and github.com/IncludeSecurity pocs
-
UnDefinedCS/HavocPwn ★ 0 · Jan 20, 2025
Expanded Exploit based on CVE-2024-41570
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.