egypt <egypt@metasploit.com>
Source-scoped identity with 30 associated PoCs and 26 linked vulnerabilities.
Exploit catalog results
Showing 25 PoCs on this page
MetasploitGeneric HTTP Command Execution
Metasploit exploitby g0tmi1kAdded to Metasploit 2026-03-24ExploitUnlinked1 file
Analysis
Technical assessment
This is a Metasploit exploit module that sends a user-supplied command payload to a vulnerable HTTP endpoint. It substitutes a placeholder in the URI or POST data with the encoded payload and sends the request to achieve remote command execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a payload withheld exploit. It sends user-supplied payloads via GET or POST requests to a configurable URI, which is consistent with its documented purpose. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The module's actions are entirely controlled by the operator through standard Metasploit datastore options.
ClassificationExploit
Model confidence98%
AuthenticationUnknown
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The module's exploit method sends a command payload to a target endpoint, which is the defining characteristic of an exploit. It is not merely a scanner because it actively delivers a payload to execute commands on the target system.
modules/exploits/multi/http/os_cmd_exec.rb:141-144Requirements
- A target HTTP endpoint that passes user-supplied input to a system command execution function (e.g., a webshell or vulnerable application).
modules/exploits/multi/http/os_cmd_exec.rb:18-20
Observed behavior
- The module sends an HTTP request (GET or POST) to a configurable URI, replacing the '!INJECT!' placeholder with the encoded command payload.
modules/exploits/multi/http/os_cmd_exec.rb:141-144 - The check method sends an 'echo' command with a random string and verifies if the response body contains that string to confirm vulnerability.
modules/exploits/multi/http/os_cmd_exec.rb:124-135
Behaviors behind the backdoor verdict
Observables
- Module Purpose
- Payload withheldThe module is designed to interact with existing command execution functionality on a target system by passing user-supplied input to system execution functions via HTTP requests.
modules/exploits/multi/http/os_cmd_exec.rb:17-19 - Payload Delivery
- Payload withheldThe exploit substitutes the placeholder '!INJECT!' in the configured URIPATH or POSTDATA with the operator's chosen payload, which is standard Metasploit behavior.
modules/exploits/multi/http/os_cmd_exec.rb:143-144 - Operator Control
- Payload withheldThe module does not perform any autonomous actions; it relies entirely on operator-provided parameters to construct and send HTTP requests.
modules/exploits/multi/http/os_cmd_exec.rb:74-80
What the analysis did not establish
- Only the module source code and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full execution context is not visible.
- The evidence does not include any runtime output or confirmation that the exploit was successfully executed against a target.
- Review is limited to the provided module source code (os_cmd_exec.rb). The behavior of included Metasploit mixins (e.g., Msf::Exploit::Remote::HttpClient, Msf::Exploit::Remote::AutoCheck) and the framework's payload handling are not expanded or analyzed.
- The analysis scope explicitly states that framework mixins, libraries, and external payloads are not expanded, so any backdoor behavior within those components would not be detected.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.