Julien Voisin
Source-scoped identity with 9 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 9 PoCs on this page
MetasploitGladinet CentreStack/Triofox Path Traversal
Metasploit auxiliary PoCby Huntress Team, plus 2 additional contributorsAdded to Metasploit 2026-02-04ExploitCVE-2025-11371CVE-2025-304061 file
Analysis
Technical assessment
A Metasploit auxiliary module that exploits CVE-2025-11371, an unauthenticated path traversal vulnerability in Gladinet CentreStack/Triofox, to read arbitrary files from the server. It includes actions to read any file or specifically extract the machineKey from Web.config for use in further attacks.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that exploits CVE-2025-11371, a path traversal vulnerability, to read arbitrary files. It contains no backdoor, concealed payload, or operator-directed harm. All behavior is consistent with documented exploit functionality.
Classification basis and observed behavior
Classification basis
The module actively sends crafted requests to exploit a path traversal vulnerability and retrieve file contents, which constitutes exploitation rather than mere scanning or detection.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:18-20modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77Requirements
- Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.10.10408.56683).
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:27-28 - The /storage/t.dn endpoint must be accessible and accept the 's' parameter with traversal sequences.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:22-23
Observed behavior
- Sends an HTTP GET request to /storage/t.dn with a path traversal payload in the 's' parameter to read an arbitrary file.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77 - If the response status is 200, the file content is returned and stored as loot.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:89-96 - The EXTRACT_MACHINEKEY action reads Web.config and extracts the machineKey for use in ViewState deserialization attacks.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-148
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module sends a GET request with a traversal path in the 's' parameter to read arbitrary files, matching the described vulnerability.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77 - File Read
- Payload withheldThe EXTRACT_MACHINEKEY action reads a file and passes content to handle_machinekey_extraction, which is a standard Metasploit mixin for extracting cryptographic keys.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-149 - Loot Storage
- Payload withheldThe module uses store_loot to save the retrieved file, which is normal Metasploit behavior for auxiliary/gather modules.
modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:116-125
What the analysis did not establish
- Only the module source and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full exploit chain (e.g., handle_machinekey_extraction) is not visible.
- The review covers only the module source file; framework mixins (e.g., Msf::Auxiliary::Gladinet, handle_machinekey_extraction) are not expanded, but their use is standard and non-suspicious.
- Binary files are not present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGladinet CentreStack/Triofox Access Ticket Forge
Metasploit auxiliary PoCby Huntress Team, plus 1 additional contributorAdded to Metasploit 2026-02-04ExploitCVE-2025-146111 file
Analysis
Technical assessment
A Metasploit auxiliary module that forges access tickets using hardcoded AES keys to read arbitrary files from vulnerable Gladinet CentreStack/Triofox servers, and can extract the machineKey from Web.config for potential RCE.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit auxiliary module that exploits CVE-2025-14611 to forge access tickets for arbitrary file read. It uses hardcoded AES keys, constructs a plaintext ticket, encrypts it, and sends it to the target. No backdoor, concealed operator-directed harm, or unrelated payload is present. The module's behavior is fully consistent with its documented purpose.
Classification basis and observed behavior
Classification basis
The module actively forges cryptographic tickets to read arbitrary files from a remote server, which constitutes exploitation of the hardcoded key vulnerability (CVE-2025-14611). It does not merely detect or scan; it performs the unauthorized action of file retrieval.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:28-44modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-131modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:163-192Requirements
- Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.12.10420.56791).
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:42-43 - The hardcoded AES keys (SysKey and SysKey1) must match those used by the target application.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:14-21
Observed behavior
- Constructs a plaintext ticket containing a filepath, empty username/password, and a far-future timestamp.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-113 - Encrypts the ticket using AES-256-CBC with hardcoded keys and encodes it in a URL-safe Base64 variant.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:125-131 - Sends an HTTP GET request to the /storage/filesvr.dn or /servlets/filesvr.dn endpoint with the forged ticket as a query parameter.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174 - If the response is 200, the file content is returned and stored as loot; the module can also parse the Web.config to extract the machineKey.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:176-192modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:225-251
Behaviors behind the backdoor verdict
Observables
- Hardcoded Key
- Payload withheldHardcoded cryptographic keys extracted from the vulnerable DLL are used to forge access tickets, which is the core of the exploit.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:20-21 - Network Request
- Payload withheldThe module sends a crafted HTTP request to the target to read arbitrary files, which is the intended exploit behavior.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174 - Data Exfiltration
- Payload withheldThe module saves the retrieved file content to the local Metasploit loot directory, which is standard auxiliary module behavior.
modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:214-222
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; the actual behavior of the included mixins (e.g., gladinet_version, handle_machinekey_extraction) is not expanded in the evidence.
- The review covers only the module source file; Metasploit framework mixins (e.g., Msf::Auxiliary::Gladinet, HttpClient) are not expanded, but the module's own code shows no backdoor behavior.
- Binary files were not inspected, but none are included in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Metasploitudev Persistence
Metasploit exploitAdded to Metasploit 2025-12-21ExploitUnlinked1 file
Analysis
Technical assessment
A Metasploit module that installs a udev rule to execute an attacker-supplied payload with root privileges when a network interface comes up, establishing persistence.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that installs a udev rule to execute a user-supplied payload when a network interface comes up. All behavior is consistent with the documented purpose of establishing persistence on a compromised Linux host. No concealed, deceptive, or unrelated harmful actions were observed.
Classification basis and observed behavior
Classification basis
The module installs a udev rule and payload to achieve persistent code execution, which is the definition of an exploit for persistence. It actively writes files and triggers execution, not merely scanning.
modules/exploits/linux/persistence/udev.rb:88-119Requirements
- An existing Metasploit session on the target (shell or meterpreter).
modules/exploits/linux/persistence/udev.rb:45 - The 'at' command must be installed and executable on the target.
modules/exploits/linux/persistence/udev.rb:25modules/exploits/linux/persistence/udev.rb:77modules/exploits/linux/persistence/udev.rb:83 - A writable directory on the target to store the payload file.
modules/exploits/linux/persistence/udev.rb:72-73 - The udev rules directory (default /lib/udev/rules.d/) must exist and be writable.
modules/exploits/linux/persistence/udev.rb:74-75
Observed behavior
- Writes a udev rule file to /lib/udev/rules.d/ that triggers execution of a payload via 'at' when a non-loopback network interface appears.
modules/exploits/linux/persistence/udev.rb:111 - Uploads a payload file (script or binary executable) to a writable directory and makes it executable.
modules/exploits/linux/persistence/udev.rb:98modules/exploits/linux/persistence/udev.rb:105 - Manually triggers the udev rule using 'udevadm trigger' to execute the payload immediately.
modules/exploits/linux/persistence/udev.rb:118
Behaviors behind the backdoor verdict
Observables
- PersistenceMechanism
- Payload withheldThis is the core advertised functionality of the module, used to maintain access on a compromised host.
modules/exploits/linux/persistence/udev.rb:22-25modules/exploits/linux/persistence/udev.rb:111 - PayloadExecution
- Payload withheldThe module writes a payload file and creates a udev rule that runs it. This is the intended exploit behavior for persistence.
modules/exploits/linux/persistence/udev.rb:97-105modules/exploits/linux/persistence/udev.rb:111 - CleanupRegistration
- Payload withheldStandard Metasploit resource script cleanup, not a backdoor.
modules/exploits/linux/persistence/udev.rb:107modules/exploits/linux/persistence/udev.rb:112
What the analysis did not establish
- Only the module source code is provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so exact behavior of upload_and_chmodx, write_file, generate_payload_exe, and cmd_exec is not visible.
- The evidence does not include runtime output or confirmation that the module successfully establishes persistence.
- Only the module source code was reviewed; the Metasploit framework mixins (e.g., Msf::Post::File, Msf::Exploit::Local::Persistence) and the generated payload are not expanded or inspected. The review assumes these standard components behave as documented.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGeoServer WMS GetMap XXE Arbitrary File Read
Metasploit auxiliary PoCby Valentin Lobstein <chocapikk@leakix.net>, plus 1 additional contributorAdded to Metasploit 2025-12-12ExploitCVE-2025-583601 file
Analysis
Technical assessment
Metasploit auxiliary module that exploits CVE-2025-58360, an unauthenticated XXE vulnerability in GeoServer WMS GetMap. It sends a crafted XML payload containing an external entity referencing a local file, then extracts the file content from the error response.
Backdoor review
No backdoor observed in reviewed code
The module is a straightforward Metasploit auxiliary module that exploits CVE-2025-58360, an XXE vulnerability in GeoServer. It sends a crafted XML payload to read a user-specified file and extracts the content from the error response. No backdoor, deceptive payload, or concealed operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The module actively sends a crafted XML payload to trigger an XXE vulnerability and reads arbitrary files from the target server, which constitutes exploitation, not just detection.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:89-98modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:108-116Requirements
- Target must be running a vulnerable GeoServer version (>= 2.26.0, <= 2.26.1 or <= 2.25.5) with the WMS endpoint accessible.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:17-23
Observed behavior
- Constructs an XXE payload with a randomized entity name that references a local file via file:// URI.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64 - Sends a POST request to the GeoServer WMS endpoint with the XXE payload as XML body.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:89-98 - Extracts the file content from the error message in the response using a regex on 'Unknown layer:'.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:81-87 - Stores the exfiltrated file content as loot in the Metasploit database.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:123-130
Behaviors behind the backdoor verdict
Observables
- File Read
- Payload withheldThe module reads an arbitrary file path supplied by the operator via the FILEPATH option, which is the intended exploit behavior for CVE-2025-58360.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:50modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:97 - Xxe Payload
- Payload withheldThe module constructs an XXE payload that defines an external entity pointing to a local file, which is the core of the documented vulnerability exploitation.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64 - Loot Storage
- Payload withheldThe retrieved file content is saved to the Metasploit loot database, which is standard behavior for auxiliary/gather modules.
modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:123-130
What the analysis did not establish
- Only the module source code is provided; Metasploit framework mixins (e.g., HttpClient, Report) are not expanded, so exact HTTP request construction and response handling details are not fully visible.
- The module's actual runtime behavior (e.g., success rate, error handling) cannot be verified from static source alone.
- Only the module source is reviewed; Metasploit framework mixins (e.g., HttpClient, Report) and external payloads are not expanded, but the module itself does not invoke any external payloads or hidden behaviors.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Metasploitupdate-motd.d Persistence
Metasploit exploitAdded to Metasploit 2025-09-09ExploitUnlinked1 file
Analysis
Technical assessment
This Metasploit module installs a persistent backdoor by writing a script to /etc/update-motd.d/ that executes a payload with root privileges upon user login.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit persistence exploit that writes a user-supplied payload to /etc/update-motd.d/. It does not contain any concealed, deceptive, or operator-directed harmful behavior beyond its documented purpose. The code is straightforward and uses only the payload provided by the Metasploit operator.
Classification basis and observed behavior
Classification basis
The module's primary operation is to install a persistent payload that executes with root privileges, which constitutes exploitation. It includes a check method but its main purpose is to deploy a backdoor.
modules/exploits/linux/persistence/motd.rb:22-26modules/exploits/linux/persistence/motd.rb:75-102Requirements
- Requires an existing Metasploit session on the target.
modules/exploits/linux/persistence/motd.rb:44 - Requires root privileges to write to /etc/update-motd.d/.
modules/exploits/linux/persistence/motd.rb:25
Observed behavior
- Checks if /etc/update-motd.d/ exists and is writable.
modules/exploits/linux/persistence/motd.rb:66-73 - Writes a shell script containing the encoded payload to /etc/update-motd.d/.
modules/exploits/linux/persistence/motd.rb:84-85 - For non-cmd payloads, uploads a payload executable and creates a script to execute it.
modules/exploits/linux/persistence/motd.rb:86-95 - Makes the backdoor script executable (chmod 755).
modules/exploits/linux/persistence/motd.rb:99
Behaviors behind the backdoor verdict
Observables
- Persistence Mechanism
- Payload withheldThis is the documented and expected behavior of the module, not a hidden backdoor.
modules/exploits/linux/persistence/motd.rb:23-26 - Payload Execution
- Payload withheldThe module uses the standard Metasploit payload generation and execution methods, with no additional hidden commands.
modules/exploits/linux/persistence/motd.rb:84-85modules/exploits/linux/persistence/motd.rb:92 - Cleanup Mechanism
- Payload withheldThe module includes standard cleanup functionality, which is consistent with legitimate persistence modules.
modules/exploits/linux/persistence/motd.rb:94modules/exploits/linux/persistence/motd.rb:98
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's behavior is inferred from source code, not from dynamic execution or runtime observation.
- The analysis is limited to the module source code and metadata. Framework mixins, libraries, and external payloads are not expanded, so any hidden behavior in those components would not be detected.
- The module's behavior depends on the payload selected by the operator; the review does not cover the safety of any specific payload.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.