theLightCosine <theLightCosine@metasploit.com>
Source-scoped identity with 9 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 9 PoCs on this page
MetasploitWebDAV PHP Upload
Metasploit exploitby g0tmi1kAdded to Metasploit 2026-04-08ExploitCVE-2012-100621 file
Analysis
Technical assessment
A Metasploit exploit module that uploads a PHP payload via WebDAV PUT request and executes it via a subsequent GET request to achieve remote code execution on vulnerable XAMPP servers.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit that uploads a PHP payload via WebDAV PUT and executes it with a GET request. All behavior is consistent with the documented exploit purpose; no concealed backdoor, credential exfiltration, persistence, or unrelated payload delivery was observed.
Classification basis and observed behavior
Classification basis
The module's exploit method uploads a PHP payload via WebDAV PUT and executes it via GET, which is the core behavior of an exploit. The check method only validates vulnerability, but the primary purpose is exploitation.
modules/exploits/multi/http/webdav_upload_php.rb:240-276Requirements
- Target must have WebDAV enabled with PHP execution support, such as default XAMPP installations.
modules/exploits/multi/http/webdav_upload_php.rb:20-23 - Valid WebDAV credentials are required; defaults to 'wampp'/'xampp'.
modules/exploits/multi/http/webdav_upload_php.rb:50-51
Observed behavior
- Sends an HTTP PUT request to upload a PHP payload to the WebDAV directory.
modules/exploits/multi/http/webdav_upload_php.rb:245-249 - Sends an HTTP GET request to the uploaded PHP file to trigger execution of the payload.
modules/exploits/multi/http/webdav_upload_php.rb:270-273 - Registers the uploaded file for cleanup after exploitation.
modules/exploits/multi/http/webdav_upload_php.rb:275
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, documented exploit flow for CVE-2012-10062.
modules/exploits/multi/http/webdav_upload_php.rb:240-276 - Credential Usage
- Payload withheldCredentials are used only for the WebDAV upload and execution requests, not exfiltrated or sent elsewhere.
modules/exploits/multi/http/webdav_upload_php.rb:50-51modules/exploits/multi/http/webdav_upload_php.rb:56-67 - Cleanup Mechanism
- Payload withheldThe module includes FileDropper and calls register_file_for_cleanup, which is standard Metasploit practice for removing artifacts after exploitation.
modules/exploits/multi/http/webdav_upload_php.rb:11modules/exploits/multi/http/webdav_upload_php.rb:275
What the analysis did not establish
- Analysis based on module source and metadata only; framework mixins, libraries, and external payloads are not expanded.
- No runtime behavior observed; classification is based on static code analysis of the supplied Ruby source.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected; metadata-only analysis was performed for any non-text content.
- The review does not assess the safety or reliability of the exploit or its payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.