wireghoul Exploits and Proofs of Concept

Showing 3 PoCs on this page

Metasploit

Apache .htaccess Persistence

Metasploit exploitby 4ravind-bAdded to Metasploit 2026-05-18ExploitUnlinked1 file

exploit_linux/persistence/apache_htaccess · Ruby

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

This Metasploit module writes a CGI shell payload into an Apache .htaccess file to establish persistence. It configures the .htaccess to act as a PHP handler, executing base64-decoded PHP or system commands passed via the query string.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit persistence exploit that writes a payload to an Apache .htaccess file to achieve CGI shell execution. It uses the framework's own payload withheld mechanism, performs a backup of the original .htaccess, and includes no hidden or unrelated malicious behavior. All actions are consistent with the described persistence functionality.

ClassificationExploit

Model confidence100%

AuthenticationRequired

Languagesruby

Target softwareApache HTTP Servermod_cgi

Attack typespersistencecommand_execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The module writes a payload (PHP or command) into a .htaccess file that is configured to execute the payload when the file is requested via the web server. This is active exploitation for persistence, not just detection.

modules/exploits/linux/persistence/apache_htaccess.rb:125-137

Requirements

Requires an existing Meterpreter or shell session on the target.modules/exploits/linux/persistence/apache_htaccess.rb:34
Apache must be running on the target.modules/exploits/linux/persistence/apache_htaccess.rb:85
The target directory must have AllowOverride All enabled in Apache configuration.modules/exploits/linux/persistence/apache_htaccess.rb:93-94
The .htaccess file must be writable by the current session user.modules/exploits/linux/persistence/apache_htaccess.rb:101
PHP must be enabled as an Apache module.modules/exploits/linux/persistence/apache_htaccess.rb:107

Observed behavior

Checks if Apache is running by examining the process list.modules/exploits/linux/persistence/apache_htaccess.rb:85
Reads Apache configuration to verify AllowOverride is set to All for the target directory.modules/exploits/linux/persistence/apache_htaccess.rb:87-97
Verifies PHP module is loaded via apache2ctl -M.modules/exploits/linux/persistence/apache_htaccess.rb:107
Backs up the existing .htaccess file to Metasploit loot.modules/exploits/linux/persistence/apache_htaccess.rb:110-123
Writes a new .htaccess file that sets a PHP handler and embeds a PHP or command payload.modules/exploits/linux/persistence/apache_htaccess.rb:125-137
Sets the .htaccess file permissions to 0755.modules/exploits/linux/persistence/apache_htaccess.rb:138

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Execution: Payload withheldThe module uses the Metasploit framework's standard payload encoding mechanism to generate the payload for the PHP or CMD target.modules/exploits/linux/persistence/apache_htaccess.rb:78-80
File Write: Payload withheldThe module writes the generated payload into the .htaccess file, which is the intended persistence mechanism.modules/exploits/linux/persistence/apache_htaccess.rb:137
Backup Mechanism: Payload withheldThe module backs up the original .htaccess file before overwriting it, which is a standard operational practice and not indicative of a backdoor.modules/exploits/linux/persistence/apache_htaccess.rb:110-121

Review boundaries

What the analysis did not establish

Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded.
The evidence does not include any runtime output or confirmation of successful execution.
The review covers only the module source code; the actual payload withheld content is not included and could contain arbitrary code, but that is a characteristic of the Metasploit framework's payload generation, not a backdoor in this module.
The module's interaction with the target system (e.g., file writes, process checks) is assumed to be as described in the code; no runtime behavior was observed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Metasploit