watchTowr
Source-scoped identity with 4 associated PoCs and 6 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
MetasploitCitrix ADC (NetScaler) CVE-2026-3055 Scanner
Metasploit auxiliary PoCby sfewer-r7Added to Metasploit 2026-03-30ScannerCVE-2026-30551 file
Analysis
Technical assessment
This Metasploit auxiliary module scans for CVE-2026-3055, a memory overread vulnerability in Citrix ADC/NetScaler when configured as a SAML IdP. It sends crafted HTTP GET requests to the /wsfed/passive endpoint with a long random Host header and a wctx parameter, then inspects the Set-Cookie header for NSC_TASS cookies containing leaked memory. The module decodes the base64-encoded leaked data and scans it for session cookies (SESSID, NITRO_SK, NSC_AAAC) to report exposure. It does not exploit the vulnerability to gain access or execute code.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a scanner for CVE-2026-3055, a memory overread vulnerability in Citrix NetScaler. The module sends crafted HTTP requests to leak memory and extracts session cookies from the response. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The code performs only the documented vulnerability scanning and reporting functions.
Classification basis and observed behavior
Classification basis
The module's primary operation is to detect and report the presence of the vulnerability by sending probe requests and analyzing responses for leaked memory and session cookies. It does not contain code to hijack sessions, execute commands, or otherwise exploit the vulnerability for unauthorized access. The module name, description, and behavior all indicate a scanner.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:16-20modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:51-87modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:89-208Requirements
- Target must be a Citrix ADC/NetScaler configured as a SAML IdP.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:18-19 - Target must be running a vulnerable version (e.g., ADC 14.1 < 66.59, 13.1 < 62.23).
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:1
Observed behavior
- Sends HTTP GET requests to /wsfed/passive with a 128-character random Host header and a wctx parameter.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:53-62 - Checks for vulnerability by verifying the presence of an NSC_TASS cookie in the 302 response; reports Safe if no cookies or no NSC_TASS cookie.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:70-83 - In run mode, sends up to LEAK_REQUEST_COUNT (default 4096) requests, extracts base64-encoded leaked data from NSC_TASS cookies, and scans for SESSID, NITRO_SK, and NSC_AAAC session cookies.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:98-188 - Reports vulnerability and leaked cookie details to the user; does not establish a session or execute commands.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:194-208
Behaviors behind the backdoor verdict
Observables
- Vulnerability Scanner
- Payload withheldThe module sends GET requests to /wsfed/passive with a long random Host header and a wctx parameter to trigger a memory leak, then parses Set-Cookie headers for leaked session cookies.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:100-109modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:140-187 - Credential Extraction
- Payload withheldThe module scans leaked memory for session cookies and reports them. This is the intended purpose of the scanner and not a hidden backdoor.
modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:160-187
What the analysis did not establish
- Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual runtime behavior, effectiveness, and safety are not verified.
- The evidence does not include any binary or compiled components.
- Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were flagged as metadata-only and not inspected, but no binary files were present in this evidence packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitIvanti Endpoint Manager Mobile (EPMM) unauthenticated RCE
Metasploit exploitby sfewer-r7Added to Metasploit 2026-02-05ExploitCVE-2026-1281CVE-2026-13401 file
Analysis
Technical assessment
A Metasploit module that exploits an unauthenticated OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) to achieve remote code execution with root privileges.
Backdoor review
No backdoor observed in reviewed code
The Metasploit module source code implements a standard exploit for CVE-2026-1281 and CVE-2026-1340. It sends a crafted HTTP request with a command injection payload to achieve unauthenticated RCE. No backdoor, deceptive payload, or concealed operator-directed harm is present. The module's behavior is consistent with its stated purpose.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively injects OS commands to achieve remote code execution. It includes both a check method for vulnerability detection and an exploit method for payload delivery.
modules/exploits/linux/http/ivanti_epmm_rce.rb:1-146Requirements
- Target must be running a vulnerable version of Ivanti EPMM.
modules/exploits/linux/http/ivanti_epmm_rce.rb:19-20
Observed behavior
- Sends a crafted HTTP GET request to the /mifs/c/appstore/fob/3/ endpoint with a malicious 'h' parameter containing a command injection payload.
modules/exploits/linux/http/ivanti_epmm_rce.rb:118-144 - The check method verifies vulnerability by injecting a sleep command and measuring response time.
modules/exploits/linux/http/ivanti_epmm_rce.rb:97-111 - The exploit method executes an arbitrary command payload via the injection point.
modules/exploits/linux/http/ivanti_epmm_rce.rb:113-115
Behaviors behind the backdoor verdict
Observables
- Command Injection
- Payload withheldThe module injects the attacker-supplied command into the 'h' parameter using backticks, which is the core exploit mechanism.
modules/exploits/linux/http/ivanti_epmm_rce.rb:122 - Payload Execution
- Payload withheldThe exploit method executes the user-selected Metasploit payload, which is standard exploit behavior.
modules/exploits/linux/http/ivanti_epmm_rce.rb:114 - Check Method
- Payload withheldThe check method uses a sleep command to verify vulnerability via response timing, a common non-destructive technique.
modules/exploits/linux/http/ivanti_epmm_rce.rb:97-101
What the analysis did not establish
- The analysis is based solely on the provided Ruby source code and metadata; no dynamic execution or external library code was inspected.
- Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected; metadata-only analysis was performed for non-text content (none present in this artifact).
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.