sfewer-r7

Classification basis

The module is a complete exploit that sends a malicious SIP INVITE to trigger a stack-based buffer overflow and execute arbitrary commands via a ROP chain, achieving remote code execution.

Requirements

• Target must have Interactive Connectivity Establishment (ICE) enabled.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:22-24
• Target must be a vulnerable HP Poly VVX or Trio model running a vulnerable firmware version.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:18-20

Observed behavior

• Sends a SIP OPTIONS request with 'Require: ice' to fingerprint the target device model and firmware version.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:199-210
• Constructs a buffer overflow payload in an SDP attribute 'a=candidate:' by filling a 256-byte buffer, overwriting saved registers, and using a ROP chain to call libc system() with an attacker-supplied command.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:140-159
• Sends a crafted SIP INVITE request containing the malicious SDP to trigger the overflow and execute the payload.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:172-185

Observables

ROP Chain

Payload withheldThe exploit uses a fixed ROP chain to redirect execution to libc!system with the attacker's command payload. This is standard exploit technique for the stated vulnerability.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:140-159

Payload Execution

Payload withheldThe module takes the user-selected Metasploit payload and appends it to the overflow buffer, which is then executed via the ROP chain. This is the intended exploit mechanism.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:114modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:159

SIP Request Construction

Payload withheldThe module builds a SIP INVITE message with a crafted SDP body that includes the overflow and ROP chain. This is the delivery mechanism for the exploit.modules/exploits/linux/misc/poly_unauth_rce_cve_2026_0826.rb:163-185

Classification basis

The module actively exploits the vulnerability by performing the authentication bypass and then injecting an SSH key to gain persistent access, which goes beyond mere detection or scanning.

Requirements

• Network access to the target's UDP port 12346 (vdaemon DTLS control-plane service).modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:64
• OpenSSL libraries available on the attacker's system for DTLS handshake via FFI.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:538-574

Observed behavior

• Performs a DTLS handshake using a self-signed certificate without verifying the server's certificate.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195
• Sends a CHALLENGE_ACK message with device type set to vHub (2) to trigger the authentication bypass.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222
• Injects an SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311
• Provides instructions to connect to the NETCONF service (TCP port 830) using the injected SSH key.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:278-296

Observables

Exploit Behavior

Payload withheldThe module sends a CHALLENGE_ACK message with device type 2 (vHub) to bypass authentication, as described in the module metadata and CVE context.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222

Exploit Behavior

Payload withheldThe module builds and sends a VMANAGE_TO_PEER message containing an attacker-controlled SSH public key, providing persistent access to the target's NETCONF service.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311

Exploit Behavior

Payload withheldThe module generates an in-memory self-signed certificate and performs a DTLS handshake without verifying the server's certificate, as required for the exploit.modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195

Classification basis

The module's primary operation is to detect and report the presence of the vulnerability by sending probe requests and analyzing responses for leaked memory and session cookies. It does not contain code to hijack sessions, execute commands, or otherwise exploit the vulnerability for unauthorized access. The module name, description, and behavior all indicate a scanner.

Requirements

• Target must be a Citrix ADC/NetScaler configured as a SAML IdP.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:18-19
• Target must be running a vulnerable version (e.g., ADC 14.1 < 66.59, 13.1 < 62.23).modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:1

Observed behavior

• Sends HTTP GET requests to /wsfed/passive with a 128-character random Host header and a wctx parameter.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:53-62
• Checks for vulnerability by verifying the presence of an NSC_TASS cookie in the 302 response; reports Safe if no cookies or no NSC_TASS cookie.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:70-83
• In run mode, sends up to LEAK_REQUEST_COUNT (default 4096) requests, extracts base64-encoded leaked data from NSC_TASS cookies, and scans for SESSID, NITRO_SK, and NSC_AAAC session cookies.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:98-188
• Reports vulnerability and leaked cookie details to the user; does not establish a session or execute commands.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:194-208

Observables

Vulnerability Scanner

Payload withheldThe module sends GET requests to /wsfed/passive with a long random Host header and a wctx parameter to trigger a memory leak, then parses Set-Cookie headers for leaked session cookies.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:100-109modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:140-187

Credential Extraction

Payload withheldThe module scans leaked memory for session cookies and reports them. This is the intended purpose of the scanner and not a hidden backdoor.modules/auxiliary/scanner/http/citrix_netscaler_cve_2026_3055.rb:160-187

Classification basis

The module actively exploits the vulnerability by sending a crafted CHALLENGE_ACK_ACK message to bypass authentication and then injects an SSH key for persistent access, which constitutes exploitation rather than mere detection or scanning.

Requirements

• Network access to the target's DTLS control-plane service on the configured port (default 12346).modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:58
• OpenSSL libraries available on the attacker's system for DTLS FFI bindings.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:510-511

Observed behavior

• Generates a self-signed certificate in memory and performs a DTLS 1.2 handshake with the target, disabling peer certificate verification.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:125modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:141-142
• Receives a CHALLENGE message from the server.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:180-196
• Sends a forged CHALLENGE_ACK_ACK message with verify_status=1 to bypass authentication.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:198-203
• Sends a Hello message to complete peering as an authenticated peer.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:224-228
• Injects an SSH public key into the vmanage-admin authorized_keys file by sending a VMANAGE_TO_PEER message, enabling persistent SSH access.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:248-256

Observables

Exploit Behavior

Payload withheldCore exploit mechanism documented in the module description and CVE context.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:198-203

Exploit Behavior

Payload withheldPost-exploitation persistence mechanism consistent with the module's stated purpose.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:248-256

Exploit Behavior

Payload withheldNecessary to establish the DTLS control-plane connection as described in the vulnerability analysis.modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb:119-178

Classification basis

The module is a complete Metasploit exploit that actively triggers a buffer overflow and executes arbitrary code on the target. It includes a check method for vulnerability detection, but its primary purpose is exploitation via the exploit method, which constructs and sends a malicious payload.

Requirements

• Target must be a Grandstream GXP1600 series device (GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, GXP1630) running firmware version below 1.0.7.81.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:106-112
• The target's HTTP service must be reachable on the configured RPORT (default 80).modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:51

Observed behavior

• Sends a POST request to /cgi-bin/api.values.get with a 'request' parameter containing a version ID to retrieve the firmware version.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:123-129
• Selects a firmware-version-specific ROP table containing addresses for system@plt, .data section, and ROP gadgets.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:137modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:263-415
• Constructs a ROP chain that overwrites the return address to execute a series of gadgets, ultimately calling system() with an attacker-supplied command (the Metasploit payload).modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:149-174
• Uses a multi-stage buffer overflow technique (gen_buffer) to write null bytes by triggering the overflow multiple times via colon-delimited identifiers.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:213-261
• Sends the final exploit request containing the overflow buffer, ROP chain, and payload to trigger the vulnerability and execute the payload.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:204-210

Observables

Exploit Mechanism

Payload withheldThe module exploits CVE-2026-2329 by sending a crafted request that overflows a stack buffer, then uses a ROP chain to call system@plt with an attacker-supplied command.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:19-23modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:149-174modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:204-210

Payload Delivery

Payload withheldThe exploit delivers the payload.encoded value as the OS command executed by the ROP chain. The payload is chosen by the Metasploit user, not hardcoded.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:49-50modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:193-198

Cleanup Behavior

Payload withheldThe module registers files for cleanup after exploitation, which is standard Metasploit practice to remove artifacts on the target.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:200-202

Classification basis

The artifact is a complete Metasploit exploit module that actively injects OS commands to achieve remote code execution. It includes both a check method for vulnerability detection and an exploit method for payload delivery.

Requirements

• Target must be running a vulnerable version of Ivanti EPMM.modules/exploits/linux/http/ivanti_epmm_rce.rb:19-20

Observed behavior

• Sends a crafted HTTP GET request to the /mifs/c/appstore/fob/3/ endpoint with a malicious 'h' parameter containing a command injection payload.modules/exploits/linux/http/ivanti_epmm_rce.rb:118-144
• The check method verifies vulnerability by injecting a sleep command and measuring response time.modules/exploits/linux/http/ivanti_epmm_rce.rb:97-111
• The exploit method executes an arbitrary command payload via the injection point.modules/exploits/linux/http/ivanti_epmm_rce.rb:113-115

Observables

Command Injection

Payload withheldThe module injects the attacker-supplied command into the 'h' parameter using backticks, which is the core exploit mechanism.modules/exploits/linux/http/ivanti_epmm_rce.rb:122

Payload Execution

Payload withheldThe exploit method executes the user-selected Metasploit payload, which is standard exploit behavior.modules/exploits/linux/http/ivanti_epmm_rce.rb:114

Check Method

Payload withheldThe check method uses a sleep command to verify vulnerability via response timing, a common non-destructive technique.modules/exploits/linux/http/ivanti_epmm_rce.rb:97-101

Classification basis

The module is a complete exploit that chains CVE-2025-40536 and CVE-2025-40551 to execute attacker-supplied payloads on the target. It includes all steps to bypass authentication, trigger deserialization, and deliver native or command payloads, and is classified as an exploit module in Metasploit.

Requirements

• Target must be a vulnerable SolarWinds Web Help Desk instance (12.7.* or 12.8.*).modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:44-78
• Attacker must be able to reach the target's web interface (default TCP 8443).modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:82-83
• For Windows 12.8.* targets, the attacker must be able to serve a DLL over SMB on TCP 445.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:185-186
• For 12.7.* targets, the attacker must be able to serve a malicious LDAP response for JNDI injection.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:213

Observed behavior

• Sends a GET request to /helpdesk/WebObjects/Helpdesk.woa with x-webobjects-recording header to obtain session tokens and version.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:293-299
• Requests the LoginPref page to extract the externalAuthContainer URL, bypassing authentication.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:359-370
• POSTs to the externalAuthContainer to trigger a SAML object, furthering the auth bypass.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:388-396
• Creates a JSON-RPC bridge by requesting LoginPref again and extracting the JSONRpcClient endpoint.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:404-415
• Sends JSON-RPC calls to wopage.setVariableValueForName and wopage.variableValueForName with malicious Java objects to trigger unsafe deserialization.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:442-477
• Delivers payload via JNDI injection (12.7.*), SMB-hosted malicious DLL (12.8.* Windows), or cron file write (12.8.* Linux).modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:207-280

Observables

Exploit Chain

Payload withheldThe module's multi-step exploit flow (steps 1-5) matches the described vulnerabilities and uses standard Metasploit payload delivery mechanisms.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:20-24modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:108-148

Payload Delivery

Payload withheldThe module delivers attacker-chosen payloads via DLL over SMB, cron job creation, or JNDI lookup, all standard for the framework.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:195modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:213modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:277

Service Cleanup

Payload withheldThe module properly cleans up the temporary SMB share used for payload delivery, which is expected operational behavior.modules/exploits/multi/http/solarwinds_webhelpdesk_rce.rb:156-167

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the CVE-2025-37164 vulnerability to achieve remote code execution. The 'exploit' method sends a malicious payload to the target, and the 'check' method uses the same vulnerability to verify exploitability.

Requirements

• Target must be running a vulnerable version of HPE OneView (below 11.00 without hotfix) with the ID Pools endpoint enabled.modules/exploits/linux/http/hpe_oneview_rce.rb:18-21

Observed behavior

• Sends a PUT request to payload withheld with a JSON body containing a 'cmd' field to execute an arbitrary system command.modules/exploits/linux/http/hpe_oneview_rce.rb:143-156
• The exploit method sends the attacker's payload encoded for shell execution via the execute_cmd function.modules/exploits/linux/http/hpe_oneview_rce.rb:121-122
• The check method exploits the vulnerability with a benign command (echo with a UUID) to determine if the target is vulnerable.modules/exploits/linux/http/hpe_oneview_rce.rb:100-102

Observables

Exploit Endpoint

Payload withheldThe module sends a PUT request to this endpoint with a JSON body containing a 'cmd' field to achieve command execution.modules/exploits/linux/http/hpe_oneview_rce.rb:144-156

Check Command

Payload withheldThe check method executes a benign echo command with a random UUID to verify vulnerability without causing harm.modules/exploits/linux/http/hpe_oneview_rce.rb:100-102

Payload Execution

Payload withheldThe exploit method wraps the user-supplied payload in a shell command for execution, which is standard for cmd-based exploits.modules/exploits/linux/http/hpe_oneview_rce.rb:121-122modules/exploits/linux/http/hpe_oneview_rce.rb:153

Classification basis

The module's primary purpose is to gain unauthorized remote code execution. It actively exploits two vulnerabilities: it sends a crafted request to bypass authentication and create an admin user, then uses that access to inject and execute an arbitrary OS command payload. The module type is 'exploit', and the code contains the full exploit logic.

Requirements

• Network access to the FortiWeb management interface (default port 443).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:103-105
• Target must be a vulnerable version of FortiWeb (e.g., 8.0.1, 7.4.8, 6.4.3, 6.3.9).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:25-42

Observed behavior

• Sends a POST request to /api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi with a crafted CGIINFO header to bypass authentication and create a new local administrator account.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:539-556
• Logs in with the newly created or supplied admin credentials to obtain an authenticated session cookie (APSCOOKIE_FWEB).modules/exploits/linux/http/fortinet_fortiweb_rce.rb:170-188
• Retrieves the target's major, minor, and patch version via the /api/v2.0/system/state endpoint to select the appropriate command injection technique.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:428-463
• Leverages a command injection in the SAML user configuration CLI (via HTTP CLI console for v6 or WebSocket for v7/v8) to write a base64-encoded bootstrap payload to disk in chunks, then decodes and executes it.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:213-299modules/exploits/linux/http/fortinet_fortiweb_rce.rb:413-426
• The bootstrap payload uses Python to detach the final Metasploit payload (e.g., reverse shell) from the CLI session to prevent premature termination.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:226-232

Observables

Exploit Chain

Payload withheldThe module first creates a new admin account via a path traversal (lines 152-166, 478-537), then logs in (lines 170-190), and finally executes a payload via command injection through the CLI (lines 202-208, 213-299). This is the documented exploit behavior.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:152-166modules/exploits/linux/http/fortinet_fortiweb_rce.rb:170-190modules/exploits/linux/http/fortinet_fortiweb_rce.rb:202-208

Payload Execution

Payload withheldThe module uploads a bootstrap payload in chunks to avoid command length limits (lines 213-298). The bootstrap payload uses Python's subprocess.Popen to detach the final Metasploit payload (lines 216-232). This is a standard technique for reliable session delivery.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:213-232modules/exploits/linux/http/fortinet_fortiweb_rce.rb:262-298

Credential Creation

Payload withheldIf no credentials are supplied, the module creates a new local admin account with random credentials (lines 152-160). This is necessary for the exploit and is not a backdoor; the credentials are printed to the operator.modules/exploits/linux/http/fortinet_fortiweb_rce.rb:152-160

Classification basis

The module actively exploits the vulnerability by sending a crafted request that bypasses authentication and creates a new admin user, which is the definition of an exploit. It does not merely check for the vulnerability; it performs the unauthorized action of account creation.

Requirements

• Target must be a vulnerable version of Fortinet FortiWeb (7.0.0-7.0.11, 7.2.0-7.2.11, 7.4.0-7.4.9, 7.6.0-7.6.4, 8.0.0-8.0.1).modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:19-26
• Network access to the FortiWeb management interface (default port 443).modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:44-46

Observed behavior

• Sends a POST request to '/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi' with a base64-encoded CGIINFO header containing default admin credentials, bypassing authentication.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:155-171
• Creates a new local administrator account with attacker-supplied username and password.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:89-128
• Stores the newly created credentials in the Metasploit database.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:152

Observables

Authentication Bypass

Payload withheldThe module uses a path traversal in the URI to bypass authentication, which is the core of the documented vulnerability.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:165

Credential Creation

Payload withheldThe module's run method sends a JSON payload to create a local admin user, consistent with the module description.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:90-128

Credential Storage

Payload withheldThe module stores the newly created username and password using the framework's credential storage API, which is normal for auxiliary modules that obtain credentials.modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:152modules/auxiliary/admin/http/fortinet_fortiweb_create_admin.rb:174-200