Zach Hanley (Horizon3.ai)

Metasploit · Author

Source-scoped identity with 1 associated PoC and 2 linked vulnerabilities.

Showing 1 PoC on this page

Metasploit

N-able N-Central Authentication Bypass and XXE Scanner

Metasploit auxiliary PoCby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2025-11-20ScannerCVE-2025-11700CVE-2025-93161 file

auxiliary_scanner/http/nable_ncentral_auth_bypass_xxe · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module scans for N-able N-Central instances vulnerable to CVE-2025-9316 (authentication bypass) and CVE-2025-11700 (XXE). It attempts to obtain an unauthenticated session via a sessionHello SOAP request, and if successful, tests for XXE by writing a payload file and triggering it. The module reports vulnerabilities and stores any exfiltrated file content as loot, but its primary stated purpose is scanning and validation, not exploitation for impact.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a scanner for CVE-2025-9316 and CVE-2025-11700. All behavior is consistent with the stated purpose: sending SOAP requests to test for authentication bypass, writing an XXE payload, triggering it, and exfiltrating file contents via an error-based out-of-band technique. No concealed, deceptive, or operator-directed harmful actions were observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagesruby
Target softwareN-able N-Central
Attack typesauthentication_bypassxxe
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is classified as a scanner because its primary purpose, as stated in its name ('Scanner'), description ('This module scans for vulnerable N-able N-Central instances'), and type ('auxiliary'), is to detect and report vulnerabilities. Although it performs actions that technically exploit the vulnerabilities (obtaining a session, reading a file via XXE), these actions serve the scanning goal of validating exposure and are not used for further post-exploitation impact. The module includes Msf::Auxiliary::Scanner and reports vulnerabilities, consistent with a scanner role.

modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:19-22modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:12modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:113-120

Requirements

  • Target must be running a vulnerable version of N-able N-Central (< 2025.4.0.9).modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:35
  • Attacker must be able to reach the target's HTTP service and run a local HTTP/HTTPS server for DTD delivery.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:78-86

Observed behavior

  • Sends a sessionHello SOAP request to /dms/services/ServerUI with appliance IDs from a configurable range to obtain an unauthenticated session ID.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:126-149
  • If a session is obtained, writes a base64-encoded XXE payload to a log file via an applianceLogSubmit SOAP request to /dms/services/ServerMMS.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:233-248
  • Triggers the XXE by calling importServiceTemplateFromFile on the written payload file, causing the target to fetch an attacker-hosted DTD and exfiltrate file contents via an error-based technique.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:250-260modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:338-350
  • Reports vulnerabilities (CVE-2025-9316 and CVE-2025-11700) and stores exfiltrated file content as loot.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:113-120modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:194-203
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
Payload withheldUsed to test for CVE-2025-9316 authentication bypass and to write/trigger XXE payload for CVE-2025-11700.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:136modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:242modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:259
Network Behavior
Payload withheldRequired for the error-based XXE technique to exfiltrate file contents from the target.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:78-86modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:338-349
File Operation
Payload withheldPart of the exploit chain for CVE-2025-11700; the payload is base64-encoded and written to a log file on the target.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:233-248
Data Exfiltration
Payload withheldThe module reads a user-specified file (default /etc/passwd) and stores it using store_loot, which is standard Metasploit behavior for captured data.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:194
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The code was not executed; classification is based on static analysis of the artifact's stated purpose and logic.
  • Only the module source code was reviewed; Metasploit framework mixins, libraries, and any external payloads were not expanded or analyzed.
  • The review is based solely on static analysis of the provided text; no dynamic execution or network traffic analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.