msutovsky-r7

Classification basis

The artifact is a complete Metasploit exploit module that actively delivers a PHP payload, causes the target to cache it, and triggers its execution to establish a remote session.

Requirements

• Ability to inject HTML/CSS into data processed by dompdf (e.g., via XSS, user-controlled form field, or direct parameter).modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:32-34
• The dompdf font cache directory (lib/fonts/) must be web-accessible.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:33-34
• For dompdf versions 0.8.6 through 1.2.0, the $isRemoteEnabled option must be set to true.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:29-30

Observed behavior

• Starts an HTTP server to serve a CSS file and a malicious PHP file with a TrueType font header and embedded PHP payload.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:210-217modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:124-148
• Injects a link to the malicious CSS into the target application via GET, POST, or JSON POST parameters.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:151-187
• Triggers execution of the cached PHP file by sending a GET request to the predicted font cache path.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:189-194
• Registers the cached PHP file for cleanup after exploitation.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:220

Observables

Exploit Mechanism

Payload withheldThis is the core exploit technique for CVE-2022-28368, matching the module description and public vulnerability details.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:124-149modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:189-194

Payload Delivery

Payload withheldStandard Metasploit practice; the payload is user-selected and not hardcoded. No hidden or unrelated payload is present.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:133

Cleanup Mechanism

Payload withheldIndicates the module attempts to remove the dropped artifact, consistent with the SideEffects note and standard Metasploit FileDropper mixin usage.modules/exploits/multi/http/dompdf_rce_cve_2022_28368.rb:220

Classification basis

The module writes a payload (PHP or command) into a .htaccess file that is configured to execute the payload when the file is requested via the web server. This is active exploitation for persistence, not just detection.

Requirements

• Requires an existing Meterpreter or shell session on the target.modules/exploits/linux/persistence/apache_htaccess.rb:34
• Apache must be running on the target.modules/exploits/linux/persistence/apache_htaccess.rb:85
• The target directory must have AllowOverride All enabled in Apache configuration.modules/exploits/linux/persistence/apache_htaccess.rb:93-94
• The .htaccess file must be writable by the current session user.modules/exploits/linux/persistence/apache_htaccess.rb:101
• PHP must be enabled as an Apache module.modules/exploits/linux/persistence/apache_htaccess.rb:107

Observed behavior

• Checks if Apache is running by examining the process list.modules/exploits/linux/persistence/apache_htaccess.rb:85
• Reads Apache configuration to verify AllowOverride is set to All for the target directory.modules/exploits/linux/persistence/apache_htaccess.rb:87-97
• Verifies PHP module is loaded via apache2ctl -M.modules/exploits/linux/persistence/apache_htaccess.rb:107
• Backs up the existing .htaccess file to Metasploit loot.modules/exploits/linux/persistence/apache_htaccess.rb:110-123
• Writes a new .htaccess file that sets a PHP handler and embeds a PHP or command payload.modules/exploits/linux/persistence/apache_htaccess.rb:125-137
• Sets the .htaccess file permissions to 0755.modules/exploits/linux/persistence/apache_htaccess.rb:138

Observables

Payload Execution

Payload withheldThe module uses the Metasploit framework's standard payload encoding mechanism to generate the payload for the PHP or CMD target.modules/exploits/linux/persistence/apache_htaccess.rb:78-80

File Write

Payload withheldThe module writes the generated payload into the .htaccess file, which is the intended persistence mechanism.modules/exploits/linux/persistence/apache_htaccess.rb:137

Backup Mechanism

Payload withheldThe module backs up the original .htaccess file before overwriting it, which is a standard operational practice and not indicative of a backdoor.modules/exploits/linux/persistence/apache_htaccess.rb:110-121

Classification basis

The module is a Metasploit exploit that actively exercises CVE-2026-46300 to overwrite a setuid binary's in-memory pages and execute a payload for privilege escalation.

Requirements

• Unprivileged local shell or meterpreter session on a vulnerable Linux host.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:50
• Kernel version >= 4.10 and vulnerable to CVE-2026-46300 (shared-frag marker lost during TCP coalescing).modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:85
• Vulnerable kernel modules (esp, ipcomp) must be loaded.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:79-81
• A setuid binary (default /usr/bin/su) must exist and be at least as large as the generated payload ELF.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:98modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:137
• Writable directory on target (default /tmp).modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:100-101
• On Ubuntu, unprivileged user namespaces must be allowed (kernel.apparmor_restrict_unprivileged_userns=0).modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:74-76

Observed behavior

• Checks for dirty-frag mitigations, vulnerable kernel modules, kernel version, and Ubuntu userns restrictions.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:66-88
• Generates a setuid payload ELF and uploads a compiled exploit binary (live compile or precompiled) to the target.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:107-125
• Executes the exploit binary, piping the base64-encoded payload ELF to it, which overwrites in-memory page-cache pages of the setuid binary.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140
• Runs the now-patched setuid binary to execute the payload with elevated privileges.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:148
• On new session, drops page cache to restore original file contents.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:151-157

Observables

Exploit Behavior

Payload withheldThe module drops an exploit binary, uses it to overwrite in-memory pages of a setuid file with attacker-controlled payload, then executes the patched binary to gain elevated privileges.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140-148

Payload Execution

Payload withheldThe module generates an ELF payload with PrependSetuid, writes it to the target, and executes the patched setuid binary to run the payload with elevated privileges.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:107-112modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:140-148

Cleanup Behavior

Payload withheldThe on_new_session callback executes 'echo 1 | tee /proc/sys/vm/drop_caches' to clear page cache, likely to restore the original setuid binary content on disk.modules/exploits/linux/local/cve_2026_46300_fragnesia.rb:151-157

Classification basis

The module's exploit method constructs and sends a SQL injection payload that inserts a command into the cron_jobs table, leading to remote code execution. This is active exploitation, not just detection.

Requirements

• Target must be running a vulnerable version of FreePBX (before 16.0.44/17.0.23 for auth bypass, before 16.0.92/17.0.6 for SQLi) with Webserver Authorization Mode enabled.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-21
• A valid FreePBX username must be supplied by the attacker.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:64

Observed behavior

• Sends a POST request to /admin/config.php with a forged Authorization header (using the supplied username and a random password) to bypass authentication.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:70-83
• Injects a SQL payload into the 'id' parameter to insert a new record into the cron_jobs table, containing the attacker's command payload.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-101
• The injected cron job is executed by the operating system, delivering a reverse shell or other command payload.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:23-25
• Attempts to clean up by deleting the injected cron job after exploitation.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:111-126

Observables

Exploit Chain

Payload withheldThe module chains two CVEs to gain unauthenticated SQL injection and then injects a cron job that executes the attacker's payload.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:18-25

Payload Execution

Payload withheldThe exploit constructs an INSERT statement that places the Metasploit payload into a cron job, which FreePBX executes on the OS.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:98-99

Cleanup

Payload withheldThe cleanup method removes the injected cron job to reduce artifacts on the target.modules/exploits/unix/http/freepbx_custom_extension_rce.rb:117

Classification basis

The module's run method executes a SQL injection payload that inserts a new administrative user into the database, which is an active exploitation action, not merely detection or scanning.

Requirements

• Target FreePBX instance must have Webserver Authorization Mode enabled for the authentication bypass (CVE-2025-66039).modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16
• Target FreePBX version must be vulnerable to CVE-2025-61675 (SQL injection in custom extension component).modules/auxiliary/gather/freepbx_custom_extension_injection.rb:16

Observed behavior

• Sends a POST request to /admin/config.php with a forged Authorization header (using an arbitrary password) to bypass authentication.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:44-57
• Injects a SQL payload via the 'id' POST parameter to insert a new administrative user into the ampusers table.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:110-111
• Validates the newly created administrative user by attempting to authenticate via /admin/ajax.php.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:85-108

Observables

Sql Injection Payload

Payload withheldThe SQL injection payload inserts a new administrative user into the ampusers table, which aligns with the module's described goal of creating an admin account.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:111

Authentication Bypass

Payload withheldThe module uses the CVE-2025-66039 authentication bypass by sending a Basic Authorization header with the target username and a random password, as described in the module metadata.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:48

Credential Validation

Payload withheldAfter creating the user, the module validates the new admin credentials by making a legitimate API call to the FreePBX admin interface. This is normal post-exploitation verification.modules/auxiliary/gather/freepbx_custom_extension_injection.rb:86-99

Classification basis

The module's primary purpose is to deploy a malicious DLL to achieve code execution and persistence. It includes a check method to verify the target environment but its main function (install_persistence) generates and writes a payload DLL to a location where it will be automatically loaded and executed by Notepad++. This constitutes an exploit as it actively exercises the vulnerability (DLL side-loading) to execute attacker-controlled code.

Requirements

• Requires an existing Meterpreter or shell session on the target Windows system.modules/exploits/windows/persistence/notepadpp_plugin.rb:26
• Notepad++ must be installed and its plugins directory must be writable.modules/exploits/windows/persistence/notepadpp_plugin.rb:57modules/exploits/windows/persistence/notepadpp_plugin.rb:62

Observed behavior

• Checks for the existence and writability of the Notepad++ plugins directory.modules/exploits/windows/persistence/notepadpp_plugin.rb:55-73
• Generates a payload DLL using Metasploit's payload generation framework.modules/exploits/windows/persistence/notepadpp_plugin.rb:81
• Creates a subdirectory under the Notepad++ plugins directory and writes the malicious DLL into it.modules/exploits/windows/persistence/notepadpp_plugin.rb:79-90
• The DLL is executed when Notepad++ is next launched, providing persistent access.modules/exploits/windows/persistence/notepadpp_plugin.rb:20

Observables

Persistence Mechanism

Payload withheldThe module installs a payload DLL into the Notepad++ plugins directory, which is loaded automatically on application startup. This is the documented purpose of the module.modules/exploits/windows/persistence/notepadpp_plugin.rb:19-20modules/exploits/windows/persistence/notepadpp_plugin.rb:52modules/exploits/windows/persistence/notepadpp_plugin.rb:76-93

Payload Generation

Payload withheldThe module generates a DLL payload using the Metasploit framework's standard payload generation method. This is expected behavior for a persistence module.modules/exploits/windows/persistence/notepadpp_plugin.rb:81

Cleanup Mechanism

Payload withheldThe module appends a command to remove the installed plugin directory to a cleanup resource script, indicating intended removal capability.modules/exploits/windows/persistence/notepadpp_plugin.rb:93

Classification basis

The module is a complete Metasploit exploit that chains two CVEs to bypass authentication, upload a PHP webshell, and execute it for remote code execution. It includes check, auth bypass, upload, and trigger methods, and is classified as 'exploit' in its own metadata.

Requirements

• FreePBX target with Webserver Authorization Mode enabled and vulnerable versions (prior to 16.0.44/17.0.23 for auth bypass; prior to 16.0.92/17.0.6 for file upload).modules/exploits/unix/http/freepbx_firmware_file_upload.rb:18
• A valid FreePBX username must be supplied via the USERNAME option.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:54

Observed behavior

• Sends a GET request to /admin/config.php to check if the target returns a 401 with 'FreePBX' in the body or a 500, indicating Webserver authentication mode is active.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:60-68
• Bypasses authentication by sending a GET request to /admin/config.php with a forged Authorization header containing the supplied username and a random password, then extracts the session cookie from the 401 response.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:73-84
• Uploads a PHP payload via a multipart POST request to /admin/ajax.php?module=endpoint&command=upload_cust_fw, using path traversal in the fwbrand parameter to place the webshell in a web-accessible directory.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:86-117
• Triggers the uploaded PHP payload by sending a GET request to the webshell's URL.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:119-124

Observables

Payload Delivery

Payload withheldThe module uploads and executes a user-supplied payload, which is standard exploit behavior.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:94-101

Authentication Bypass

Payload withheldThe module uses a forged Authorization header to bypass authentication, consistent with CVE-2025-66039.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:77

Path Traversal

Payload withheldThe module uses path traversal in the fwbrand parameter to place the webshell in the web root, consistent with CVE-2025-61678.modules/exploits/unix/http/freepbx_firmware_file_upload.rb:98

Classification basis

The module is a fully functional exploit that actively delivers and executes a payload on the target system. It includes code to start a malicious FTP server, trigger the vulnerable downloadFile action, serve a PHP payload, and execute it via HTTP.

Requirements

• Target must be running a vulnerable version of Monsta FTP (< 2.11.3).modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:22
• Attacker must be able to host an FTP server reachable by the target.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:238-239

Observed behavior

• Starts a malicious FTP server that authenticates any client with generated credentials.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:128-143
• Sends an HTTP POST request to the target's API to trigger the downloadFile action, instructing it to connect to the attacker's FTP server and download a PHP file.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:204-224
• Serves a PHP payload (meterpreter or command shell) when the target requests the file via FTP RETR.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:118-126
• Triggers execution of the uploaded PHP payload by sending an HTTP GET request to the payload's location on the target.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:245-246

Observables

Exploit Mechanism

Payload withheldThe module starts an FTP server (line 128-143) that serves a PHP payload (line 123) when the target connects and issues a RETR command. This matches the CVE description of arbitrary file upload from a malicious FTP server.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:128-143modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:118-126

Payload Generation

Payload withheldThe module generates a PHP payload using Metasploit's payload framework (line 92-95). For PHP targets, it uses the selected payload directly; for command targets, it wraps the command in a PHP exec call. This is standard exploit behavior.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:92-95

Http Trigger

Payload withheldThe module sends a crafted HTTP request to the target's API endpoint (line 208-224) to trigger the downloadFile action, causing the target to connect back to the attacker's FTP server and download the payload. This is the core exploit trigger.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:204-230

Cleanup Registration

Payload withheldThe module registers the uploaded payload file for cleanup (line 244), which is a standard Metasploit practice to remove artifacts after exploitation. This is not malicious behavior.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:244

Classification basis

The module's primary operation is to install a persistent backdoor by writing a malicious Python startup hook file that executes an attacker-supplied payload. This constitutes an exploit because it actively deploys code to maintain unauthorized access, going beyond mere detection or scanning.

Requirements

• Requires an existing session on the target system.modules/exploits/multi/persistence/python_site_specific_hook.rb:30
• Python must be installed on the target system.modules/exploits/multi/persistence/python_site_specific_hook.rb:91
• The target Python site-specific or dist-packages directory must be writable by the current user.modules/exploits/multi/persistence/python_site_specific_hook.rb:107

Observed behavior

• Detects the installed Python version by executing 'python3 --version', 'python2 --version', or 'python --version' on the target.modules/exploits/multi/persistence/python_site_specific_hook.rb:80-83
• Determines the path to the Python site-packages or dist-packages directory based on the target OS and whether persistence is for the current user or all users.modules/exploits/multi/persistence/python_site_specific_hook.rb:57-74
• Creates a .pth file in the hooks directory containing an 'import os;os.system("<payload>")' command, which will be executed automatically when Python starts.modules/exploits/multi/persistence/python_site_specific_hook.rb:119

Observables

Payload Execution

Payload withheldThe module writes a file containing a Python command that executes the attacker-chosen payload. This is the core persistence mechanism and is explicitly described in the module's metadata.modules/exploits/multi/persistence/python_site_specific_hook.rb:119

Persistence Mechanism

Payload withheldThe module targets Python's startup hook mechanism to achieve persistence, as described in the module's description and references.modules/exploits/multi/persistence/python_site_specific_hook.rb:21-22

Classification basis

The module is a fully implemented exploit that actively sends crafted HTTP requests to trigger a deserialization vulnerability and execute an attacker-supplied payload on the target. It includes a check method but its primary purpose is exploitation.

Requirements

• Target must be running a vulnerable version of WSUS on port 8530.modules/exploits/windows/http/wsus_deserialization_rce.rb:33
• Attacker must wait for WSUS to synchronize (default WfsDelay 900 seconds) for the payload to execute.modules/exploits/windows/http/wsus_deserialization_rce.rb:34

Observed behavior

• Sends a SOAP request to retrieve the WSUS server ID.modules/exploits/windows/http/wsus_deserialization_rce.rb:68-85
• Obtains an authorization cookie from the SimpleAuthWebService.modules/exploits/windows/http/wsus_deserialization_rce.rb:87-106
• Retrieves encrypted reporting parameters (cookie) from the ClientWebService.modules/exploits/windows/http/wsus_deserialization_rce.rb:108-137
• Generates a serialized payload using the WindowsIdentity gadget chain and SoapFormatter.modules/exploits/windows/http/wsus_deserialization_rce.rb:141-145
• Crafts a malicious ReportEventBatch SOAP request containing the serialized payload in the SynchronizationUpdateErrorsKey field.modules/exploits/windows/http/wsus_deserialization_rce.rb:147-190
• Sends the malicious event to the ReportingWebService, which will be deserialized during the next WSUS synchronization, executing the payload.modules/exploits/windows/http/wsus_deserialization_rce.rb:192-195

Observables

Payload Generation

Payload withheldThe module generates a deserialization payload using the standard Metasploit framework utility, which is expected behavior for an exploit module.modules/exploits/windows/http/wsus_deserialization_rce.rb:141-145

Payload Delivery

Payload withheldThe generated payload is embedded in a SOAP request field, which is the intended delivery mechanism for the exploit.modules/exploits/windows/http/wsus_deserialization_rce.rb:178

Classification basis

The module is a Metasploit exploit that writes a payload to a periodic execution directory, achieving persistence. It includes a check method to verify writability and an install_persistence method that deploys the payload, which is the core behavior of an exploit.

Requirements

• Requires an existing session (shell or meterpreter) with root privileges.modules/exploits/multi/persistence/periodic_script.rb:24
• Requires the /etc/periodic directory to be writable.modules/exploits/multi/persistence/periodic_script.rb:66

Observed behavior

• Checks if the target /etc/periodic subdirectory is writable.modules/exploits/multi/persistence/periodic_script.rb:63-69
• Writes a payload script to the periodic directory and makes it executable.modules/exploits/multi/persistence/periodic_script.rb:71-83
• Generates a payload binary or script based on the selected target architecture and writes it to the periodic directory.modules/exploits/multi/persistence/periodic_script.rb:85-103

Observables

Persistence Mechanism

Payload withheldThe module's stated purpose is to achieve persistence by writing a script to the periodic directory. The code in write_periodic_script (lines 71-83) and install_persistence (lines 85-103) implements this behavior directly.modules/exploits/multi/persistence/periodic_script.rb:22-24modules/exploits/multi/persistence/periodic_script.rb:71-83modules/exploits/multi/persistence/periodic_script.rb:85-103

Payload Generation

Payload withheldThe module generates payloads using the framework's standard methods, which are expected for a Metasploit exploit module. No custom or obfuscated payloads are embedded.modules/exploits/multi/persistence/periodic_script.rb:95modules/exploits/multi/persistence/periodic_script.rb:97modules/exploits/multi/persistence/periodic_script.rb:99

Privilege Requirement

Payload withheldThe module description (line 24) and check method (lines 63-69) indicate root privileges are needed. This is consistent with the intended persistence mechanism and not a hidden malicious requirement.modules/exploits/multi/persistence/periodic_script.rb:24modules/exploits/multi/persistence/periodic_script.rb:63-69

Classification basis

The module contains explicit code to exploit CVE-2023-28458 by writing a malicious Python hook to the target filesystem and executing an attacker-supplied payload. The exploit method constructs a path traversal payload, uploads a resource with OS command execution, and triggers the file write via schedule export.

Requirements

• Valid Pretalx organizer credentials (EMAIL, PASSWORD)modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:52-53
• Pretalx must be running in debug modemodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:66
• Target Pretalx version <= 2.3.1modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:68

Observed behavior

• Logs into Pretalx with supplied credentialsmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:60
• Registers a malicious speaker and proposalmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:84-91
• Uploads a resource containing a Python payload that executes an OS commandmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:101-103
• Uses a path traversal in the proposal description to write the uploaded resource to a Python site-packages hook locationmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:112
• Triggers the file write by adding the proposal to the schedule, releasing the schedule, and exporting it as ZIPmodules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:114-120

Observables

Payload Execution

Payload withheldThe module writes a Python hook that executes the Metasploit payload. This is the intended exploit behavior, not a backdoor.modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:103

Path Traversal

Payload withheldThe path traversal is the core of CVE-2023-28458 exploitation, used to place the payload hook in a Python site-packages directory. This is the documented vulnerability, not a backdoor.modules/exploits/linux/http/pretalx_rce_cve_2023_28458.rb:112

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by uploading a malicious file and executing it to gain a session. It includes authentication, file upload, and trigger logic, which constitutes exploitation, not just detection or analysis.

Requirements

• Target must be running a vulnerable version of Sitecore PowerShell Extensions (through 7.0) on Sitecore XP 10.0.0 to 10.4.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:79
• The module authenticates using hardcoded credentials for the ServicesAPI account (username 'ServicesAPI', password 'b') via CVE-2025-34509.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119

Observed behavior

• Authenticates to the target Sitecore instance using the hardcoded ServicesAPI credentials.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119
• Generates a payload executable and wraps it in an ASPX webshell.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:87-88
• Uploads the ASPX webshell via a multipart POST request to the vulnerable PowerShellUploadFile2.aspx endpoint.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:90-104
• Triggers the uploaded webshell by sending a GET request to its location, executing the payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:111-116

Observables

Hardcoded Credential Use

Payload withheldThe module uses hardcoded credentials to authenticate, which is part of the documented exploit chain (CVE-2025-34509). This is normal exploit behavior, not a backdoor.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119

Payload Generation

Payload withheldThe module generates a payload executable and wraps it as an ASPX webshell, which is standard Metasploit behavior for achieving remote code execution on the target.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:87-88

File Upload Endpoint

Payload withheldThe module uploads the generated ASPX file to the vulnerable PowerShell extension endpoint, consistent with the CVE description.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:72modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:100

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by authenticating, uploading a malicious ZIP with a path traversal payload, and executing arbitrary code on the target.

Requirements

• Target must be running a vulnerable version of Sitecore (9.0-9.3, 10.0-10.4) with the hardcoded ServicesAPI credentials active.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:22modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:70-72

Observed behavior

• Authenticates to the target using hardcoded credentials ('ServicesAPI' / 'b') via the login_identitysrv method.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:340
• Elevates privileges by obtaining identity cookies via get_identity_cookies.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:66modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:344
• Navigates a multi-step upload wizard (Upload2.aspx) to prepare for a ZIP upload with the 'Unzip' option enabled.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:88-297
• Generates a malicious ZIP archive containing a path traversal filename ('//\\/../' + webshell_file) and an ASPX webshell payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:299-307
• Uploads the malicious ZIP via a multipart POST request, exploiting the Zip Slip vulnerability to write the webshell to an arbitrary location.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:309-325
• Triggers the uploaded webshell by sending a GET request to the webshell's URL, executing the payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:332-336modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:350

Observables

Hardcoded Credential

Payload withheldUsed for authentication as part of the exploit chain (CVE-2025-34509). This is the documented vulnerability, not a backdoor.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:340

Path Traversal Payload

Payload withheldThe ZIP slip path traversal writes an ASPX webshell to the web root. This is the core exploit mechanism.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:301-305

Payload Generation

Payload withheldStandard Metasploit payload generation; the resulting executable is embedded in the ASPX webshell.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:302-303