Remote Code Execution in EMCO Software Updater

This repository provides a proof-of-concept exploit for CVE-2022-28944, affecting multiple EMCO Software products on Windows. The exploit demonstrates how an attacker can achieve remote code execution by spoofing the update server (storage.emcosoftware.com) and serving a malicious update. The repository contains three files: a README.md with detailed exploitation steps, a Python script (cve-2022-28944_poc.py) that implements a malicious HTTPS server mimicking the update endpoint, and a C source file (proof.c) for compiling a Windows binary (proof.exe) that simply launches cmd.exe. The attack requires redirecting the victim's update requests to the attacker's server, which can be achieved via hosts file modification or network-level spoofing. The Python server responds to update requests with XML instructing the client to download and execute proof.exe, demonstrating arbitrary code execution. The exploit is a functional proof-of-concept and does not include advanced payloads or automation for network redirection.