Heads up to people/orgs running ConnectWise ScreenConnect. There is a bad-as-it-gets bug being exploited right now that is basically no-tech hacking to gain remote admin access. Patch now if you haven't already.

ConnectWise's advisory on the vulnerabilities and exploitation is here:

https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8

A working proof of concept for this attack:

https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc

Huntress does a good job dissecting the ConnectWise advisory and showing the exploit in action.

https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass

https://www.youtube.com/watch?v=AWGoGO5jnvY

@wdormann sums up the technical capabilities needed to exploit this flaw:

"Apparently the exploit is to add a '/' to the end of the URI.
That's it."

https://infosec.exchange/@wdormann/111969450560709377