Gabriel Gomes

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

Tactical RMM Jinja2 SSTI Remote Code Execution

Metasploit exploitby Valentin Lobstein <chocapikk@leakix.net>Added to Metasploit 2026-02-23ExploitCVE-2025-695161 file

exploit_linux/http/tacticalrmm_ssti_rce_cve_2025_69516 · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-69516, a Jinja2 SSTI vulnerability in Tactical RMM, to achieve remote code execution. It authenticates, obtains a token, and sends a crafted Jinja2 template to execute arbitrary Python code on the server.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit for CVE-2025-69516, a Jinja2 SSTI vulnerability in Tactical RMM. It authenticates, checks the version, confirms SSTI, and delivers a payload via the vulnerable endpoint. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwareTactical RMM
Attack typesserver-side template injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that actively exercises the vulnerability to achieve remote code execution. It includes authentication, version checking, SSTI payload generation, and payload delivery for multiple target architectures.

modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:6modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:17-18modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:200-204modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:213-228

Requirements

  • Valid Tactical RMM credentials with Report Viewer or Report Manager permissionsmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:26
  • Target running Tactical RMM version prior to 1.4.0modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:19-20

Observed behavior

  • Authenticates to the Tactical RMM API using provided credentials to obtain a Knox tokenmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:118-132
  • Sends a POST request to the /reporting/templates/preview/ endpoint with a Jinja2 SSTI payload in the template_md parametermodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:141-158
  • The SSTI payload uses Jinja2 to access Python builtins and execute arbitrary code via threading and execmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:200-204
  • Delivers a Metasploit payload (Python, Unix command, or Linux x64 ELF) for remote code executionmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:213-228
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThe module sends a Jinja2 expression to the /reporting/templates/preview/ endpoint to achieve remote code execution.modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:200-204
Payload Delivery
Payload withheldThe exploit supports three target types, delivering the selected Metasploit payload through the SSTI vulnerability.modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:213-228
Review boundaries

What the analysis did not establish

  • Analysis is based on module source code and metadata only; framework mixins, libraries, and external payloads are not expanded.
  • The module code was not executed; classification is based on static analysis of the provided source.
  • Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads referenced by the module were not expanded or analyzed.
  • The review does not assess the safety or reliability of the exploit or its payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.