g0tmi1k
Source-scoped identity with 14 associated PoCs and 11 linked vulnerabilities.
Exploit catalog results
Showing 14 PoCs on this page
MetasploitAnonymous FTP Access Detection
Metasploit auxiliary PoCby Matteo Cantoni <goony@nothink.org>Added to Metasploit 2026-05-06ScannerCVE-1999-04971 file
Analysis
Technical assessment
This Metasploit auxiliary module detects whether an FTP server allows anonymous login and determines if the access is read-only or read/write. It does not exploit a vulnerability; it only checks for and reports the presence of anonymous FTP access.
Backdoor review
No backdoor observed in reviewed code
The module is a straightforward Metasploit auxiliary scanner that checks for anonymous FTP access. It performs only the documented actions: attempting an anonymous login, optionally testing write access by creating and removing a directory, optionally listing directory contents and storing them as loot, and reporting the result. No concealed executable behavior, unrelated payloads, credential exfiltration, persistence mechanisms, or deceptive instructions were observed.
Classification basis and observed behavior
Classification basis
The module's description states it 'Detect[s] anonymous (read/write) FTP service access.' Its code performs login checks, write-access tests, and reports findings without delivering a payload or gaining unauthorized access beyond the anonymous login itself. This is consistent with a scanner, not an exploit.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:16-17modules/auxiliary/scanner/ftp/ftp_anonymous.rb:42-97Requirements
- Network connectivity to an FTP server on the configured port (default 21).
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:36
Observed behavior
- Attempts to connect and login to the target FTP server with anonymous credentials.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:43 - Tests write access by creating and then removing a randomly named directory.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:46-54 - Optionally retrieves and stores a directory listing as loot.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:61-72 - Reports the vulnerability 'Anonymous FTP Access' and registers the anonymous credentials.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:75-84
Behaviors behind the backdoor verdict
Observables
- Module Behavior
- Payload withheldThis is the documented purpose of the module and is consistent with normal auxiliary scanner functionality.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:42-57 - Module Behavior
- Payload withheldStoring loot is a standard Metasploit feature for evidence collection, not a backdoor.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:61-72 - Module Behavior
- Payload withheldStandard Metasploit reporting functions; no external exfiltration.
modules/auxiliary/scanner/ftp/ftp_anonymous.rb:75-84modules/auxiliary/scanner/ftp/ftp_anonymous.rb:99-133
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins and libraries (e.g., Msf::Exploit::Remote::Ftp) are not expanded, so the exact implementation of connect_login and send_cmd is not inspected.
- Review is limited to the module source code; Metasploit framework mixins (e.g., Msf::Exploit::Remote::Ftp, Msf::Auxiliary::Scanner) are not expanded, so their internal behavior is not inspected.
- Binary files were not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitWebDAV PHP Upload
Metasploit exploitby theLightCosine <theLightCosine@metasploit.com>Added to Metasploit 2026-04-08ExploitCVE-2012-100621 file
Analysis
Technical assessment
A Metasploit exploit module that uploads a PHP payload via WebDAV PUT request and executes it via a subsequent GET request to achieve remote code execution on vulnerable XAMPP servers.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit that uploads a PHP payload via WebDAV PUT and executes it with a GET request. All behavior is consistent with the documented exploit purpose; no concealed backdoor, credential exfiltration, persistence, or unrelated payload delivery was observed.
Classification basis and observed behavior
Classification basis
The module's exploit method uploads a PHP payload via WebDAV PUT and executes it via GET, which is the core behavior of an exploit. The check method only validates vulnerability, but the primary purpose is exploitation.
modules/exploits/multi/http/webdav_upload_php.rb:240-276Requirements
- Target must have WebDAV enabled with PHP execution support, such as default XAMPP installations.
modules/exploits/multi/http/webdav_upload_php.rb:20-23 - Valid WebDAV credentials are required; defaults to 'wampp'/'xampp'.
modules/exploits/multi/http/webdav_upload_php.rb:50-51
Observed behavior
- Sends an HTTP PUT request to upload a PHP payload to the WebDAV directory.
modules/exploits/multi/http/webdav_upload_php.rb:245-249 - Sends an HTTP GET request to the uploaded PHP file to trigger execution of the payload.
modules/exploits/multi/http/webdav_upload_php.rb:270-273 - Registers the uploaded file for cleanup after exploitation.
modules/exploits/multi/http/webdav_upload_php.rb:275
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, documented exploit flow for CVE-2012-10062.
modules/exploits/multi/http/webdav_upload_php.rb:240-276 - Credential Usage
- Payload withheldCredentials are used only for the WebDAV upload and execution requests, not exfiltrated or sent elsewhere.
modules/exploits/multi/http/webdav_upload_php.rb:50-51modules/exploits/multi/http/webdav_upload_php.rb:56-67 - Cleanup Mechanism
- Payload withheldThe module includes FileDropper and calls register_file_for_cleanup, which is standard Metasploit practice for removing artifacts after exploitation.
modules/exploits/multi/http/webdav_upload_php.rb:11modules/exploits/multi/http/webdav_upload_php.rb:275
What the analysis did not establish
- Analysis based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
- No runtime behavior observed; classification is based on static code analysis of the supplied Ruby source.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected; metadata-only analysis was performed for any non-text content.
- The review does not assess the safety or reliability of the exploit or its payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGeneric HTTP Command Execution
Metasploit exploitby egypt <egypt@metasploit.com>Added to Metasploit 2026-03-24ExploitUnlinked1 file
Analysis
Technical assessment
This is a Metasploit exploit module that sends a user-supplied command payload to a vulnerable HTTP endpoint. It substitutes a placeholder in the URI or POST data with the encoded payload and sends the request to achieve remote command execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a payload withheld exploit. It sends user-supplied payloads via GET or POST requests to a configurable URI, which is consistent with its documented purpose. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The module's actions are entirely controlled by the operator through standard Metasploit datastore options.
Classification basis and observed behavior
Classification basis
The module's exploit method sends a command payload to a target endpoint, which is the defining characteristic of an exploit. It is not merely a scanner because it actively delivers a payload to execute commands on the target system.
modules/exploits/multi/http/os_cmd_exec.rb:141-144Requirements
- A target HTTP endpoint that passes user-supplied input to a system command execution function (e.g., a webshell or vulnerable application).
modules/exploits/multi/http/os_cmd_exec.rb:18-20
Observed behavior
- The module sends an HTTP request (GET or POST) to a configurable URI, replacing the '!INJECT!' placeholder with the encoded command payload.
modules/exploits/multi/http/os_cmd_exec.rb:141-144 - The check method sends an 'echo' command with a random string and verifies if the response body contains that string to confirm vulnerability.
modules/exploits/multi/http/os_cmd_exec.rb:124-135
Behaviors behind the backdoor verdict
Observables
- Module Purpose
- Payload withheldThe module is designed to interact with existing command execution functionality on a target system by passing user-supplied input to system execution functions via HTTP requests.
modules/exploits/multi/http/os_cmd_exec.rb:17-19 - Payload Delivery
- Payload withheldThe exploit substitutes the placeholder '!INJECT!' in the configured URIPATH or POSTDATA with the operator's chosen payload, which is standard Metasploit behavior.
modules/exploits/multi/http/os_cmd_exec.rb:143-144 - Operator Control
- Payload withheldThe module does not perform any autonomous actions; it relies entirely on operator-provided parameters to construct and send HTTP requests.
modules/exploits/multi/http/os_cmd_exec.rb:74-80
What the analysis did not establish
- Only the module source code and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full execution context is not visible.
- The evidence does not include any runtime output or confirmation that the exploit was successfully executed against a target.
- Review is limited to the provided module source code (os_cmd_exec.rb). The behavior of included Metasploit mixins (e.g., Msf::Exploit::Remote::HttpClient, Msf::Exploit::Remote::AutoCheck) and the framework's payload handling are not expanded or analyzed.
- The analysis scope explicitly states that framework mixins, libraries, and external payloads are not expanded, so any backdoor behavior within those components would not be detected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.