jheysel-r7
Source-scoped identity with 51 associated PoCs and 59 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
MetasploitPterodactyl Panel CVE-2025-49132 Remote Code Execution
Metasploit exploitby 0xtenshoAdded to Metasploit 2026-07-27ExploitCVE-2025-491321 file
Analysis
Technical assessment
Metasploit module that exploits CVE-2025-49132 in Pterodactyl Panel < 1.11.11 to achieve unauthenticated remote code execution via path traversal and PEAR command injection through the /locales/locale.json endpoint.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard remote code execution exploit for CVE-2025-49132 in Pterodactyl Panel. It uses path traversal and PEAR command injection to upload and execute a user-supplied payload. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The module's behavior is consistent with its documented purpose.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that includes check, upload, and execute methods to achieve remote code execution on a vulnerable target. It generates and delivers a payload, not merely detecting the vulnerability.
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:8modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:107-113modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:115-135modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:137-149Requirements
- Target must be running Pterodactyl Panel version < 1.11.11
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:21 - Target must have the /locales/locale.json endpoint accessible
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:75
Observed behavior
- Sends a GET request to /locales/locale.json with path traversal in the locale parameter to create a PHP payload file in /tmp via PEAR config-create command injection
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:155-159 - Sends a second GET request to /locales/locale.json to execute the uploaded PHP payload by including it via namespace parameter
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:162-166 - Payload is a PHP one-liner that executes a Metasploit-generated command payload using system()
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:151-153
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe module exploits the vulnerability as described in the CVE and module metadata. It does not perform any unrelated actions.
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:20-27modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:107-113modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:155-160modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:162-167 - Payload Generation
- Payload withheldThe module generates a PHP one-liner that executes the Metasploit payload. This is a standard technique for command execution exploits.
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:151-153 - Cleanup Registration
- Payload withheldThe module registers the uploaded payload file for cleanup, which is a standard Metasploit practice and not indicative of backdoor behavior.
modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:133
What the analysis did not establish
- Analysis is based on module source code only; framework mixins, libraries, and external payloads are not expanded.
- No runtime behavior or target interaction was observed; classification relies on static code analysis of the provided Ruby source.
- Only the module source code and metadata were reviewed. The Metasploit framework mixins (e.g., Msf::Exploit::Remote::HttpClient, Msf::Exploit::FileDropper) and the external payload generation logic were not expanded or inspected.
- Binary files were not present in the evidence.
- The review does not assess the safety or reliability of the exploit against the target application.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitNTLM Relay to Self (HTTP to LDAP) - Post Exploitation
Metasploit exploitAdded to Metasploit 2026-06-15ExploitUnlinked1 file
Analysis
Technical assessment
This is a Metasploit local exploit module that performs an NTLM relay-to-self privilege escalation attack. It starts an HTTP-to-LDAP relay server, coerces the local machine account to authenticate, relays the NTLM authentication to a Domain Controller's LDAP service to write Shadow Credentials, obtains a Kerberos TGT via PKINIT, performs S4U2Proxy to impersonate Administrator, and uses psexec to gain SYSTEM access on the same host.
Backdoor review
No backdoor observed in reviewed code
The module performs a documented NTLM relay-to-self privilege escalation chain. All actions (starting a relay server, coercing authentication, writing shadow credentials, obtaining Kerberos tickets, and optional psexec) align with the stated exploit purpose. No concealed operator-directed harm, unrelated payload delivery, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit module of type 'exploit' that implements a multi-step privilege escalation chain. It actively coerces authentication, relays it, modifies AD objects, obtains Kerberos tickets, and launches a payload to gain SYSTEM access. This is code intended to exercise a vulnerability, not merely detect it.
modules/exploits/windows/local/ntlm_relay_2_self.rb:6modules/exploits/windows/local/ntlm_relay_2_self.rb:137-157modules/exploits/windows/local/ntlm_relay_2_self.rb:560-588Requirements
- Requires an existing Meterpreter session on the target Windows host.
modules/exploits/windows/local/ntlm_relay_2_self.rb:40 - The target system must be configured to allow NTLMv1 responses (LmCompatibilityLevel <= 2).
modules/exploits/windows/local/ntlm_relay_2_self.rb:640-641 - The session token must have the LOCAL SID (S-1-2-0) for the ETW WebClient service trigger.
modules/exploits/windows/local/ntlm_relay_2_self.rb:667-671 - A connected Metasploit database is required to track Kerberos tickets.
modules/exploits/windows/local/ntlm_relay_2_self.rb:626-628
Observed behavior
- Starts an HTTP relay server on the compromised host bound to the Meterpreter session.
modules/exploits/windows/local/ntlm_relay_2_self.rb:146-148 - Triggers the WebClient service via an ETW event using railgun to call EventRegister and EventWrite.
modules/exploits/windows/local/ntlm_relay_2_self.rb:166-233 - Coerces machine account authentication by calling EFS APIs (OpenEncryptedFileRaw, EncryptFile, DecryptFile) with a WebDAV UNC path pointing to the relay listener.
modules/exploits/windows/local/ntlm_relay_2_self.rb:242-264 - On relay success, creates an LDAP session and spawns a thread to run the post-relay chain.
modules/exploits/windows/local/ntlm_relay_2_self.rb:267-285 - Writes Shadow Credentials (msDS-KeyCredentialLink) to the machine's AD object via the shadow_credentials module.
modules/exploits/windows/local/ntlm_relay_2_self.rb:307-308 - Configures Resource-Based Constrained Delegation (RBCD) for the machine account to itself.
modules/exploits/windows/local/ntlm_relay_2_self.rb:313-314 - Obtains a Kerberos TGT via PKINIT using the shadow credentials certificate, then performs S4U2Proxy to get a service ticket impersonating Administrator.
modules/exploits/windows/local/ntlm_relay_2_self.rb:319 - Optionally executes psexec against the local host using the obtained Kerberos ticket to gain a new elevated session.
modules/exploits/windows/local/ntlm_relay_2_self.rb:560-588 - Performs cleanup by removing the added Shadow Credentials and RBCD delegation.
modules/exploits/windows/local/ntlm_relay_2_self.rb:328-341
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe module's behavior matches its description: it relays machine account NTLM authentication to LDAP, writes msDS-KeyCredentialLink, obtains a Kerberos ticket, and optionally executes psexec for SYSTEM access.
modules/exploits/windows/local/ntlm_relay_2_self.rb:20-32 - Option
- Payload withheldThe module does not automatically attempt lateral movement; psexec is opt-in, reducing unintended harm.
modules/exploits/windows/local/ntlm_relay_2_self.rb:66-69 - Cleanup
- Payload withheldThe module includes cleanup logic to remove the added KeyCredentialLink and RBCD delegation, consistent with a legitimate privilege escalation tool.
modules/exploits/windows/local/ntlm_relay_2_self.rb:328-341
What the analysis did not establish
- Analysis is based solely on the module source code and metadata. Framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
- The evidence does not include runtime behavior, execution results, or verification that the exploit works as described.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads are not expanded and could contain unrelated behavior.
- Binary files were not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGladinet CentreStack/Triofox Path Traversal
Metasploit auxiliary PoCby Huntress Team, plus 2 additional contributorsAdded to Metasploit 2026-02-04ExploitCVE-2025-11371CVE-2025-304061 file
Analysis
Technical assessment
A Metasploit auxiliary module that exploits CVE-2025-11371, an unauthenticated path traversal vulnerability in Gladinet CentreStack/Triofox, to read arbitrary files from the server. It includes actions to read any file or specifically extract the machineKey from Web.config for use in further attacks.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that exploits CVE-2025-11371, a path traversal vulnerability, to read arbitrary files. It contains no backdoor, concealed payload, or operator-directed harm. All behavior is consistent with documented exploit functionality.
Classification basis and observed behavior
Classification basis
The module actively sends crafted requests to exploit a path traversal vulnerability and retrieve file contents, which constitutes exploitation rather than mere scanning or detection.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:18-20modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77Requirements
- Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.10.10408.56683).
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:27-28 - The /storage/t.dn endpoint must be accessible and accept the 's' parameter with traversal sequences.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:22-23
Observed behavior
- Sends an HTTP GET request to /storage/t.dn with a path traversal payload in the 's' parameter to read an arbitrary file.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77 - If the response status is 200, the file content is returned and stored as loot.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:89-96 - The EXTRACT_MACHINEKEY action reads Web.config and extracts the machineKey for use in ViewState deserialization attacks.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-148
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module sends a GET request with a traversal path in the 's' parameter to read arbitrary files, matching the described vulnerability.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77 - File Read
- Payload withheldThe EXTRACT_MACHINEKEY action reads a file and passes content to handle_machinekey_extraction, which is a standard Metasploit mixin for extracting cryptographic keys.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-149 - Loot Storage
- Payload withheldThe module uses store_loot to save the retrieved file, which is normal Metasploit behavior for auxiliary/gather modules.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:116-125
What the analysis did not establish
- Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full exploit chain (e.g., handle_machinekey_extraction) is not visible.
- The review covers only the module source file; framework mixins (e.g., Msf::Auxiliary::Gladinet, handle_machinekey_extraction) are not expanded, but their use is standard and non-suspicious.
- Binary files are not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061
Metasploit exploitby Kyu NeushwaisteinAdded to Metasploit 2026-02-04ExploitCVE-2026-240611 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2026-24061, an authentication bypass in GNU Inetutils telnetd. It sends a crafted Telnet sub-negotiation containing the USER environment variable set to '-f root', which is passed unsanitized to /usr/bin/login, resulting in a root shell without authentication.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented authentication bypass exploit for CVE-2026-24061. It constructs Telnet sub-negotiation options to inject '-f root' as the USER environment variable, which is the described vulnerability mechanism. The module sends a standard Metasploit payload at the end of the negotiation, consistent with normal exploit behavior. No concealed executable behavior, unrelated remote access, persistence, credential theft, or deceptive payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively sends crafted Telnet data to bypass authentication and execute a payload on the target. It includes the full exploit logic, not just detection or scanning.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:6modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:125-139modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:147-148Requirements
- Target must be running a vulnerable version of GNU Inetutils telnetd (up to 2.7).
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:27-28 - Attacker must be able to establish a TCP connection to the Telnet service (default port 23).
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:64
Observed behavior
- Connects to the target Telnet service and performs a standard Telnet option negotiation sequence.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:82-123 - Sends a Telnet sub-negotiation (SB) for NEW_ENVIRON with the USER variable set to '-f root' to trigger the authentication bypass.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:125-139 - After the bypass, sends a payload (e.g., a command shell) to be executed on the target.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:147-148
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThis is the documented authentication bypass technique for CVE-2026-24061, matching the CVE description and module metadata.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:131-135 - Payload Delivery
- Payload withheldStandard Metasploit exploit behavior: after bypassing authentication, the module sends the configured payload to obtain a session.
modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb:146-148
What the analysis did not establish
- Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full execution context is not available.
- Review is limited to the module source code and metadata. Framework mixins (e.g., Msf::Exploit::Remote::Telnet, Msf::Exploit::Capture) and the final payload.encoded content are not expanded or inspected.
- Binary files were not present in the evidence; the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, but no binary files were included.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitSmarterTools SmarterMail GUID File Upload Vulnerability
Metasploit exploitby Piotr Bazydlo, plus 1 additional contributorAdded to Metasploit 2026-01-22ExploitCVE-2025-526911 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2025-52691, a pre-auth directory traversal in SmarterMail's /api/upload endpoint, to upload an ASPX web shell (Windows) or a cron-based payload (Unix) for remote code execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented exploit for CVE-2025-52691. It uploads an ASPX web shell (Windows) or a cron-based command payload (Unix) to achieve remote code execution, consistent with the stated vulnerability and module description. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit functionality was observed.
Classification basis and observed behavior
Classification basis
The module is a complete exploit that actively uploads and executes a payload on a vulnerable target. It constructs a malicious request with directory traversal, delivers a web shell or cron-based command execution, and triggers the payload to gain a session. This matches the 'exploit' classification as code intended to exercise a vulnerability for remote code execution.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:6modules/exploits/multi/http/smartermail_guid_file_upload.rb:103-128modules/exploits/multi/http/smartermail_guid_file_upload.rb:130-158Requirements
- Target must be running a vulnerable version of SmarterMail (before 100.0.9413).
modules/exploits/multi/http/smartermail_guid_file_upload.rb:20 - The /api/upload endpoint must be accessible and accept multipart POST requests.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:114-119
Observed behavior
- Sends a multipart POST request to /api/upload with a contextData JSON field containing a 'guid' key with directory traversal sequences (e.g., '../' repeated) to place a file outside the intended upload directory.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:111 - On Windows, uploads an ASPX web shell that executes an attacker-supplied command via cmd.exe, then triggers it with an HTTP GET request.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:79-97modules/exploits/multi/http/smartermail_guid_file_upload.rb:135-142 - On Unix, uploads a raw command payload to /tmp and writes a cron job to /etc/cron.d that executes the payload every minute.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldConsistent with module description of uploading a malicious ASPX web shell to the web root for RCE.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:133-136 - Exploit Behavior
- Payload withheldConsistent with module description of leveraging the upload vulnerability for RCE; cron job executes the uploaded payload.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156 - Exploit Behavior
- Payload withheldMatches the CVE description of unsanitized guid key allowing directory traversal to upload files to arbitrary locations.
modules/exploits/multi/http/smartermail_guid_file_upload.rb:111
What the analysis did not establish
- Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
- The module's actual runtime behavior, reliability, and safety are not verified; classification reflects the artifact's apparent purpose as described in the code.
- Only the module source file was reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files were flagged as metadata-only and not inspected, but no binary files were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.