remmons-r7
Source-scoped identity with 10 associated PoCs and 15 linked vulnerabilities.
Exploit catalog results
Showing 10 PoCs on this page
MetasploitHPE OneView unauthenticated RCE
Metasploit exploitby Nguyen Quoc Khanh, plus 1 additional contributorAdded to Metasploit 2025-12-19ExploitCVE-2025-371641 file
Analysis
Technical assessment
This is a Metasploit exploit module for CVE-2025-37164, an unauthenticated remote code execution vulnerability in HPE OneView. It sends a crafted PUT request to the payload withheld endpoint to execute arbitrary commands on the target.
Backdoor review
No backdoor observed in reviewed code
The supplied Metasploit module source code implements a straightforward unauthenticated RCE exploit for CVE-2025-37164 against HPE OneView. It sends a crafted PUT request to the payload withheld endpoint to execute a user-supplied payload. No backdoor, deceptive payload, persistence mechanism, credential theft, or unrelated remote access behavior is present. The module's check method uses a benign echo command, and the exploit method executes the attacker-chosen payload, which is standard Metasploit exploit behavior.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively exercises the CVE-2025-37164 vulnerability to achieve remote code execution. The 'exploit' method sends a malicious payload to the target, and the 'check' method uses the same vulnerability to verify exploitability.
modules/exploits/linux/http/hpe_oneview_rce.rb:121-122modules/exploits/linux/http/hpe_oneview_rce.rb:100-102Requirements
- Target must be running a vulnerable version of HPE OneView (below 11.00 without hotfix) with the ID Pools endpoint enabled.
modules/exploits/linux/http/hpe_oneview_rce.rb:18-21
Observed behavior
- Sends a PUT request to payload withheld with a JSON body containing a 'cmd' field to execute an arbitrary system command.
modules/exploits/linux/http/hpe_oneview_rce.rb:143-156 - The exploit method sends the attacker's payload encoded for shell execution via the execute_cmd function.
modules/exploits/linux/http/hpe_oneview_rce.rb:121-122 - The check method exploits the vulnerability with a benign command (echo with a UUID) to determine if the target is vulnerable.
modules/exploits/linux/http/hpe_oneview_rce.rb:100-102
Behaviors behind the backdoor verdict
Observables
- Exploit Endpoint
- Payload withheldThe module sends a PUT request to this endpoint with a JSON body containing a 'cmd' field to achieve command execution.
modules/exploits/linux/http/hpe_oneview_rce.rb:144-156 - Check Command
- Payload withheldThe check method executes a benign echo command with a random UUID to verify vulnerability without causing harm.
modules/exploits/linux/http/hpe_oneview_rce.rb:100-102 - Payload Execution
- Payload withheldThe exploit method wraps the user-supplied payload in a shell command for execution, which is standard for cmd-based exploits.
modules/exploits/linux/http/hpe_oneview_rce.rb:121-122modules/exploits/linux/http/hpe_oneview_rce.rb:153
What the analysis did not establish
- Analysis is based solely on the provided Ruby source code and metadata; framework mixins, libraries, and external payloads are not included.
- The code was not executed, and its operational reliability or safety is not verified.
- Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or inspected.
- Binary files were flagged as metadata-only and not analyzed, but no binary files were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitTwonky Server Log Leak Authentication Bypass
Metasploit auxiliary PoCAdded to Metasploit 2025-11-19ExploitCVE-2025-13315CVE-2025-133161 file
Analysis
Technical assessment
Metasploit auxiliary module that exploits CVE-2025-13315 to bypass authentication and leak encrypted admin credentials from Twonky Server logs, then exploits CVE-2025-13316 to decrypt the password using hardcoded keys.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit auxiliary module source code implements a documented exploit for CVE-2025-13315 and CVE-2025-13316 against Twonky Server 8.5.2. It performs HTTP requests to leak a log file, extracts encrypted credentials, and decrypts them using hardcoded keys. No concealed, deceptive, or operator-directed harmful behavior was observed. The module's actions align with its stated purpose of credential recovery.
Classification basis and observed behavior
Classification basis
The module actively sends HTTP requests to exploit an authentication bypass (CVE-2025-13315) to leak credentials and then decrypts them (CVE-2025-13316) to obtain plaintext admin credentials. This constitutes exploitation, not mere scanning or detection.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:15-19modules/auxiliary/gather/twonky_authbypass_logleak.rb:48-120Requirements
- Target must be running Twonky Server version 8.5.2.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:61 - Target must be reachable over HTTP on the configured port (default 9000).
modules/auxiliary/gather/twonky_authbypass_logleak.rb:42
Observed behavior
- Sends an unauthenticated GET request to /dev0/desc.xml to confirm the target is Twonky Server 8.5.2.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:51-56 - Sends an unauthenticated GET request to payload withheld to leak application logs containing the admin username and encrypted password.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:68-73 - Extracts the admin username from the leaked log using a regex pattern.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:78-79 - Extracts the encrypted password and key index from the leaked log using a regex pattern.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:90-91 - Decrypts the password using Blowfish-ECB with a hardcoded static key selected by the key index.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:123-152 - Stores the recovered credentials as loot and reports the vulnerability.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:113-119
Behaviors behind the backdoor verdict
Observables
- Hardcoded Encryption Keys
- Payload withheldStatic keys used for Blowfish ECB decryption of the target's encrypted password, as described in CVE-2025-13316.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:125-138 - Target Endpoint
- Payload withheldThe privileged API endpoint accessed without authentication to leak the application log, exploiting CVE-2025-13315.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:68-73 - Credential Extraction
- Payload withheldThe module parses the leaked log to obtain the administrator username and encrypted password.
modules/auxiliary/gather/twonky_authbypass_logleak.rb:78-104
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module code was not executed; classification is based on static analysis of the source.
- Only the module source code was reviewed; Metasploit framework mixins, libraries, and any external payloads were not expanded or analyzed.
- The review does not assess the safety or reliability of the module when executed against a target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitCommvault Command-Line Argument Injection to Traversal Remote Code Execution
Metasploit exploitby Piotr Bazydlo, plus 1 additional contributorAdded to Metasploit 2025-09-06ExploitCVE-2025-4428CVE-2025-57788CVE-2025-57790CVE-2025-577911 file
Analysis
Technical assessment
A Metasploit module that exploits an unauthenticated remote code execution chain in Commvault (CVE-2025-57790, CVE-2025-57791, CVE-2025-57788) to achieve command execution as NETWORK SERVICE on Windows.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented exploit chain (CVE-2025-57788, CVE-2025-57790, CVE-2025-57791) against Commvault. All actions—credential leakage, authentication bypass, path traversal, and expression language injection—serve the stated purpose of achieving remote code execution. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential exfiltration to a third party, persistence mechanisms, or unrelated payload delivery) was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that implements a multi-step attack chain to achieve remote code execution. It includes code to leak credentials, bypass authentication, inject commands, and execute arbitrary payloads on the target.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:6modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:422-491Requirements
- Target must be a vulnerable Commvault instance (versions <= 11.32.101 or <= 11.36.59).
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:1 - The target must be running on Windows.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:437-439
Observed behavior
- Leaks the PublicSharingUser GUID password via an unauthenticated endpoint.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:84-100 - Authenticates as PublicSharingUser and leaks the target hostname and OS.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:137-181 - Bypasses authentication to obtain a localadmin token via command-line argument injection.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:237-254 - Leaks the full installation path using an authenticated API.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:256-268 - Uploads an XML file, injects an expression language payload into the localadmin user description, moves the XML file to a JSP web shell, and triggers remote code execution.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:307-394 - Cleans up the injected user description and registers the web shell for cleanup.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-393
Behaviors behind the backdoor verdict
Observables
- Credential Leakage
- Payload withheldPart of the documented exploit chain (CVE-2025-57788) to gain initial low-privilege access.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:94-95 - Authentication Bypass
- Payload withheldImplements CVE-2025-57791 to escalate privileges to localadmin.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:247-252 - Remote Code Execution
- Payload withheldImplements CVE-2025-57790 to achieve RCE; payload is the user-supplied Metasploit payload.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:310modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:490 - Cleanup Mechanism
- Payload withheldModule attempts to restore the modified user description and registers the web shell for deletion, consistent with normal Metasploit post-exploitation cleanup.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:375modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-392
What the analysis did not establish
- Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual behavior and reliability on live targets have not been verified through execution.
- Analysis is limited to the module source code and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded or reviewed.
- Binary files are not present in the evidence; no binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.