LoTuS and friends

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE

Metasploit exploitby ling101wAdded to Metasploit 2026-02-13ExploitCVE-2026-244791 file

exploit_linux/http/hustoj_problem_import_rce · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-24479 in HUSTOJ. It authenticates as an admin, uploads a crafted ZIP archive containing path traversal sequences to write a PHP web shell and an ELF payload to the server, then triggers the PHP shell to execute the payload for remote code execution.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2026-24479. It authenticates to HUSTOJ, uploads a crafted ZIP archive containing a path-traversal payload (ELF) and a PHP caller, then triggers the PHP to execute the payload. All behavior is consistent with the described exploit and contains no concealed backdoor, credential exfiltration, persistence, or unrelated payload delivery.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRuby
Target softwareHUSTOJ
Attack typesRemote Code ExecutionPath TraversalZip Slip
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by authenticating, uploading a crafted zip-slip payload, and executing arbitrary code on the target. It includes full logic for payload generation, delivery, and triggering, which is the definition of an exploit.

modules/exploits/linux/http/hustoj_problem_import_rce.rb:196-250

Requirements

  • Valid administrative credentials for the HUSTOJ instance.modules/exploits/linux/http/hustoj_problem_import_rce.rb:58-59
  • Target must be running a vulnerable version of HUSTOJ (prior to 26.01.24).modules/exploits/linux/http/hustoj_problem_import_rce.rb:99-100

Observed behavior

  • Authenticates to the HUSTOJ web application using provided username and MD5-hashed password.modules/exploits/linux/http/hustoj_problem_import_rce.rb:108-117
  • Generates an ELF payload and a PHP caller script, then packages them into a ZIP archive with directory traversal paths (e.g., ../../tmp/...) to exploit a zip-slip vulnerability.modules/exploits/linux/http/hustoj_problem_import_rce.rb:220-232
  • Uploads the malicious ZIP file to /admin/problem_import_qduoj.php, causing the server to extract the PHP shell into the webroot and the ELF payload into /tmp.modules/exploits/linux/http/hustoj_problem_import_rce.rb:144-165
  • Triggers the dropped PHP shell via an HTTP GET request, which executes the ELF payload to establish a reverse shell or other session.modules/exploits/linux/http/hustoj_problem_import_rce.rb:168-180
  • Cleans up dropped files by requesting a cleanup PHP script.modules/exploits/linux/http/hustoj_problem_import_rce.rb:183-193
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Payload Generation
Payload withheldUses the standard Metasploit payload generation API to create the ELF payload that will be executed on the target.modules/exploits/linux/http/hustoj_problem_import_rce.rb:204
Php Caller
Payload withheldThe PHP script planted in the webroot executes the uploaded ELF payload. This is the standard RCE mechanism for the exploit.modules/exploits/linux/http/hustoj_problem_import_rce.rb:216
Cleanup Mechanism
Payload withheldThe module includes a cleanup routine that deletes the dropped ELF and PHP files from the target, which is a normal post-exploitation hygiene practice.modules/exploits/linux/http/hustoj_problem_import_rce.rb:183-193modules/exploits/linux/http/hustoj_problem_import_rce.rb:218-219
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact was not executed, so its operational reliability or safety is not assessed.
  • Only the module source file was reviewed; Metasploit framework mixins, libraries, and the generated payload itself are not expanded or analyzed.
  • Binary content of the generated ZIP and ELF payload is not inspected; the review assumes the standard Metasploit payload generation behaves as documented.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.