↓ Skip to main content
bubka hacks stuff

T1190

HTB-Packet_Puzzle

SOC Network Analysis Windows CVE-2024-4577 T1190 Wireshark
Analyzed network traffic showing exploitation of CVE-2024-4577 (PHP-CGI argument injection) against a Windows server running PHP 8.1.25. Attacker achieved RCE, established reverse shell on port 4545, then escalated privileges using GodPotato to spawn a SYSTEM-level shell on port 5555.