MadLicense

This repository is a small standalone proof-of-concept for CVE-2024-38077 ('MadLicense'), targeting Microsoft Windows Remote Desktop Licensing Service over DCERPC. It contains two files: a README describing the vulnerability, affected versions, setup, and mitigation; and a single Python script, exploit.py, which is the operational entry point. The exploit is network-based and pre-authentication. The Python code builds simplified RPC bind/request packets, queries TCP/135 for the RPC Endpoint Mapper, and attempts to identify or fall back to the expected dynamic RPC port range used by the Remote Desktop Licensing service (49664-49681). It then constructs a malformed licensing request with a forged length field and oversized blob intended to trigger a heap-based buffer overflow in the service's request handling. The blob is filled with 0x41 bytes and described as a shellcode placeholder, but no real shellcode, callback, or post-exploitation logic is implemented. Based on the available code and README, this is best characterized as a crash/reproduction PoC rather than a reliable weaponized RCE exploit. It demonstrates the attack path and malformed packet construction needed to reach the vulnerable code path, but does not provide a working SYSTEM shell, persistence, lateral movement, or payload staging. The repository does not appear to belong to a larger exploit framework.

This repository provides a Python proof-of-concept exploit for CVE-2024-38077 (MadLicense), a critical heap buffer overflow vulnerability in the Windows Remote Desktop Licensing Service (RDL). The exploit (30877.py) leverages the impacket library to craft and send malicious RPC requests to the TermServLicensing named pipe over TCP port 135, targeting the vulnerable CDataCoding::DecodeData() function. The exploit supports two modes: a scanner mode to check for vulnerability without crashing the service, and an exploit mode to trigger remote code execution as SYSTEM. The README.md offers detailed background, usage instructions, affected systems (Windows Server 2000-2025 with RDL enabled), and mitigation advice. No hardcoded shell or advanced payload is included; the code is a functional PoC demonstrating the vulnerability and its impact. The only code file is 30877.py, which is the main entry point and contains all exploit logic. No external endpoints or C2 infrastructure are present.

This repository is a C++ project targeting Windows, structured as a Visual Studio solution. The main exploit logic resides in 'client/client.cpp' and 'client/client — копия.cpp'. The code interacts with a remote RPC service, likely exploiting a vulnerability in the service's handling of RPC calls. The exploit constructs and encodes payloads, possibly for heap spraying or arbitrary memory manipulation, and sends them via RPC. There is also code for RSA encryption and MD5 hashing, suggesting the exploit may need to authenticate or encode data in a specific way to trigger the vulnerability. The project includes standard Visual Studio project files and a custom MD5 implementation. No hardcoded IP addresses or URLs are present, but the exploit is clearly designed for network-based attacks against a Windows RPC service. The exploit is a proof-of-concept and would require adaptation for weaponization.

This repository contains a Python proof-of-concept exploit for CVE-2024-38077, a pre-authentication remote code execution vulnerability in the Windows Remote Desktop Licensing Service (TermService). The main file, 'CVE-2024-38077-poc.py', leverages the impacket library to interact with the vulnerable RPC interface (UUID 3d267954-eeb7-11d1-b94e-00c04fa3080d) exposed by the service. The exploit works by connecting to the target's RPC service, leaking memory addresses, and then hijacking execution flow to load a malicious DLL from an attacker-controlled SMB share. The attacker must provide the target IP, the IP of their SMB server, and the path to the malicious DLL. The exploit is a proof-of-concept and does not include the actual DLL payload. The repository also includes a minimal README. No hardcoded IPs or credentials are present; all endpoints are supplied via command-line arguments. The exploit demonstrates the vulnerability and provides a clear path to achieving RCE on vulnerable systems.

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-38077, a critical remote code execution vulnerability in the Windows Remote Desktop Licensing Service (termservice). The repository consists of two files: a README.md providing a detailed description of the vulnerability, affected systems, and mitigation advice, and poc.py, a Python script that implements the PoC exploit. The script uses the Impacket library to interact with the target service over the network via RPC (specifically, the ncacn_np transport to the termservice named pipe). It requires valid credentials to authenticate to the target and attempts to trigger a heap overflow by sending crafted RPC messages. The code defines several NDR structures and RPC call classes to communicate with the service. While the script demonstrates the vulnerability trigger, it does not include a full exploit chain for arbitrary code execution. The main entry point is poc.py, and the primary fingerprintable endpoint is the RPC interface for the Remote Desktop Licensing Service. The exploit is a network-based PoC targeting Windows Server 2016/2019/2022 and Windows 10/11 with the service installed.

This repository contains a working exploit (EXP) and a proof-of-concept (POC) for CVE-2024-38077, a pre-authentication remote code execution vulnerability in the Windows Remote Desktop Licensing Service (RDL) on Windows Server 2025. The main exploit file (CVE-2024-38077-EXP.py) is a Python script that leverages the impacket library to interact with the vulnerable RPC interface (UUID 3d267954-eeb7-11d1-b94e-00c04fa3080d, version 1.0) exposed by the RDL service. The exploit establishes a connection to the target's RDL service, leaks memory addresses to bypass ASLR, and then hijacks execution flow to load and execute a user-supplied DLL (evil_dll_path) from an attacker-controlled SMB share (evil_ip). The POC script (CVE-2024-38077-POC.py) demonstrates the vulnerability and information leak but does not execute a payload. The repository is structured with two main Python scripts (EXP and POC), a README with usage instructions, and several IDE configuration files. The exploit requires network access to the target's RDL service and a malicious DLL accessible via SMB. Successful exploitation results in arbitrary code execution on the target server.