Crypto-Cat
Source-scoped identity with 4 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 4 PoCs on this page
MetasploitWordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
Metasploit exploitby Adam Kues, plus 3 additional contributorsAdded to Metasploit 2026-07-31ExploitCVE-2026-60137CVE-2026-630301 file
Analysis
Technical assessment
A Metasploit exploit module that chains CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch route confusion) to achieve unauthenticated remote code execution on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. It uses SQL injection to read the database prefix and admin ID, poisons the object cache to publish a crafted customizer changeset, re-enters the REST API with admin privileges to create a new administrator account, logs in, uploads a plugin containing a Metasploit payload, and executes it.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit that chains two WordPress CVEs to achieve unauthenticated RCE. It creates an admin account, uploads a payload plugin, executes it, and cleans up. No concealed operator-directed harm, unrelated payloads, or deceptive behavior was found.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively exercises the vulnerabilities to achieve remote code execution. It includes code to check for vulnerability, perform SQL injection, poison the object cache, escalate privileges, create an admin account, upload a payload, and execute it. The module type is 'exploit' and the description states it 'gain[s] unauthenticated remote code execution'.
modules/exploits/multi/http/wp_batch_desync_rce.rb:1-812modules/exploits/multi/http/wp_batch_desync_rce.rb:42-58Requirements
- Target must be running a vulnerable version of WordPress (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API batch endpoint reachable.
modules/exploits/multi/http/wp_batch_desync_rce.rb:44-46 - At least one published post or page must exist on the target for oEmbed resolution.
modules/exploits/multi/http/wp_batch_desync_rce.rb:193 - The target must not use a persistent object cache that prevents forged UNION rows from surviving into the cache.
modules/exploits/multi/http/wp_batch_desync_rce.rb:163
Observed behavior
- Checks if the target is running a vulnerable WordPress version and confirms the batch route-confusion SQL injection is exploitable via in-band UNION.
modules/exploits/multi/http/wp_batch_desync_rce.rb:125-171 - Discovers the WordPress database table prefix and an existing administrator user ID via SQL injection.
modules/exploits/multi/http/wp_batch_desync_rce.rb:255-286 - Seeds oEmbed cache posts by injecting forged posts containing embed shortcodes, then extracts their post IDs.
modules/exploits/multi/http/wp_batch_desync_rce.rb:301-321 - Builds a poison graph and forged wp_posts rows to poison the object cache, then triggers the escalation chain to create a new administrator account via the REST API.
modules/exploits/multi/http/wp_batch_desync_rce.rb:323-347 - Logs in as the newly created administrator, uploads a plugin containing a Metasploit payload, and executes it to obtain a session.
modules/exploits/multi/http/wp_batch_desync_rce.rb:215-222 - Cleans up by removing the uploaded plugin and the created administrator account (unless KeepAdmin is set).
modules/exploits/multi/http/wp_batch_desync_rce.rb:224-238
Behaviors behind the backdoor verdict
Observables
- Credential Creation
- Payload withheldThe module creates a new WordPress administrator account to upload and execute a payload. This is documented exploit behavior, not a backdoor.
modules/exploits/multi/http/wp_batch_desync_rce.rb:328-333 - Payload Upload
- Payload withheldThe module uploads a plugin containing the user-selected Metasploit payload and triggers it. This is standard Metasploit exploit behavior.
modules/exploits/multi/http/wp_batch_desync_rce.rb:427-443 - Cleanup
- Payload withheldThe module removes the created admin account and uploaded plugin after obtaining a session, unless KeepAdmin is set. This is normal cleanup, not concealment.
modules/exploits/multi/http/wp_batch_desync_rce.rb:224-238
What the analysis did not establish
- Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not included.
- The analysis is based solely on static review of the source code; the module was not executed, and its behavior is inferred from the code logic.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected; metadata-only analysis was performed for any non-text content.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitGogs Git Rebase Argument Injection RCE
Metasploit exploitAdded to Metasploit 2026-05-28ExploitCVE-2026-528061 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2026-52806, an argument injection vulnerability in Gogs (< 0.14.3). It creates a pull request with a malicious branch name containing '--exec=<CMD>' to achieve remote code execution during a rebase merge.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2026-52806. It authenticates to a Gogs instance, creates or uses a repository, pushes a malicious branch name containing a `--exec=` argument injection, and triggers a rebase merge to execute the attacker-supplied payload. All behavior is consistent with the documented exploit flow. No concealed backdoor, unrelated payload, or operator-directed harm beyond the intended exploitation was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively exercises CVE-2026-52806 by injecting a malicious branch name to execute arbitrary commands on the target server. It includes all steps: authentication, repository setup, payload construction, branch pushing, pull request creation, and merge triggering.
modules/exploits/multi/http/gogs_rebase_rce.rb:1-757Requirements
- Authenticated Gogs user with repository creation or write/merge access to an existing repository.
modules/exploits/multi/http/gogs_rebase_rce.rb:119-130 - Local git installation required on the attacker's machine.
modules/exploits/multi/http/gogs_rebase_rce.rb:194 - Target Gogs instance must be vulnerable (version < 0.14.3).
modules/exploits/multi/http/gogs_rebase_rce.rb:183-184
Observed behavior
- Authenticates to the Gogs instance using username/password and creates an API token.
modules/exploits/multi/http/gogs_rebase_rce.rb:204-207 - Creates a new repository or validates access to an existing one, and enables rebase merge if configured.
modules/exploits/multi/http/gogs_rebase_rce.rb:209-232 - Constructs a malicious branch name containing '--exec=' with a base64-encoded payload (Unix) or a script file reference (Windows).
modules/exploits/multi/http/gogs_rebase_rce.rb:234-259 - Uses local git to push the malicious branch and a feature branch to the target repository.
modules/exploits/multi/http/gogs_rebase_rce.rb:398-450 - Creates a pull request between the malicious branch and the feature branch.
modules/exploits/multi/http/gogs_rebase_rce.rb:498-525 - Triggers a rebase merge via HTTP POST, causing the server to execute the injected command.
modules/exploits/multi/http/gogs_rebase_rce.rb:527-553 - Performs cleanup by deleting the repository (own_repo) or deleting branches and closing the PR (existing_repo).
modules/exploits/multi/http/gogs_rebase_rce.rb:630-756
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe module constructs a branch name containing `--exec=` to inject a command into `git rebase`, which is the documented vulnerability.
modules/exploits/multi/http/gogs_rebase_rce.rb:247modules/exploits/multi/http/gogs_rebase_rce.rb:258 - Payload Execution
- Payload withheldThe module uses the standard Metasploit payload mechanism; the payload is base64-encoded (Unix) or written to a script file (Windows) and executed by the injected command.
modules/exploits/multi/http/gogs_rebase_rce.rb:239modules/exploits/multi/http/gogs_rebase_rce.rb:255 - Authentication
- Payload withheldThe module logs in via web form and creates a persistent API token for subsequent API calls; this is necessary for the exploit and is disclosed in the description.
modules/exploits/multi/http/gogs_rebase_rce.rb:204-206modules/exploits/multi/http/gogs_rebase_rce.rb:297-315 - Side Effect
- Payload withheldThe module warns that the created API token cannot be automatically removed, which is a known limitation of the Gogs API.
modules/exploits/multi/http/gogs_rebase_rce.rb:648-651
What the analysis did not establish
- Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The evidence does not include any execution output or verification that the exploit works.
- Review is limited to the module source and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files are flagged as metadata-only and were not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitCisco Catalyst SD-WAN Controller vHub Authentication Bypass
Metasploit auxiliary PoCby sfewer-r7Added to Metasploit 2026-05-15ExploitCVE-2026-201821 file
Analysis
Technical assessment
This Metasploit auxiliary module exploits CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a CHALLENGE_ACK claiming to be a vHub (device type 2) to bypass authentication, and then injects an attacker-controlled SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message, providing persistent SSH access.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented authentication bypass exploit (CVE-2026-20182) against Cisco Catalyst SD-WAN Controller. It performs a DTLS handshake with a self-signed certificate, sends a crafted CHALLENGE_ACK claiming to be a vHub device to bypass authentication, and optionally injects an SSH public key into the vmanage-admin user's authorized_keys file for persistent NETCONF access. All behavior is consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The module actively exploits the vulnerability by performing the authentication bypass and then injecting an SSH key to gain persistent access, which goes beyond mere detection or scanning.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:86-101modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:105-134Requirements
- Network access to the target's UDP port 12346 (vdaemon DTLS control-plane service).
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:64 - OpenSSL libraries available on the attacker's system for DTLS handshake via FFI.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:538-574
Observed behavior
- Performs a DTLS handshake using a self-signed certificate without verifying the server's certificate.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195 - Sends a CHALLENGE_ACK message with device type set to vHub (2) to trigger the authentication bypass.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222 - Injects an SSH public key into the vmanage-admin user's authorized_keys file via a VMANAGE_TO_PEER message.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311 - Provides instructions to connect to the NETCONF service (TCP port 830) using the injected SSH key.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:278-296
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module sends a CHALLENGE_ACK message with device type 2 (vHub) to bypass authentication, as described in the module metadata and CVE context.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:215-222 - Exploit Behavior
- Payload withheldThe module builds and sends a VMANAGE_TO_PEER message containing an attacker-controlled SSH public key, providing persistent access to the target's NETCONF service.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:266-311 - Exploit Behavior
- Payload withheldThe module generates an in-memory self-signed certificate and performs a DTLS handshake without verifying the server's certificate, as required for the exploit.
modules/auxiliary/admin/networking/cisco_sdwan_vhub_auth_bypass.rb:136-195
What the analysis did not establish
- Analysis is based solely on the provided module source code and metadata; the code was not executed, and its effectiveness or safety is not verified.
- The evidence does not include the framework mixins, libraries, or external payloads referenced by the module, so the full runtime behavior cannot be assessed.
- Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were not inspected (none present in evidence).
- The review does not assess the safety or reliability of the exploit against production systems.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitcPanel/WHM CRLF Injection Authentication Bypass RCE
Metasploit exploitby Adam Kues, plus 2 additional contributorsAdded to Metasploit 2026-05-15ExploitCVE-2026-419401 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2026-41940, a CRLF injection vulnerability in cPanel/WHM's cpsrvd daemon, to achieve unauthenticated remote code execution as root. It bypasses authentication by injecting session fields via a crafted Basic-auth header, promotes them to the session cache, uses the WHM JSON API to set a temporary root password, and delivers a payload over SSH.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented exploit for CVE-2026-41940. It performs authentication bypass via CRLF injection, sets a temporary root password, delivers a payload over SSH, and rotates the password. All behavior is consistent with the stated exploit purpose and contains no concealed, deceptive, or unrelated harmful actions.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that performs authentication bypass and remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects session fields, promotes them, sets a root password, and opens an SSH command shell to deliver a payload. The module type is 'exploit' and the source metadata confirms it is an exploit.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:11modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:222-355modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:24Requirements
- Target must be running a vulnerable version of cPanel/WHM (after 11.40, before patched versions).
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:39-41 - Target must have WHM service accessible on the configured RPORT (default 2087) with SSL enabled.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:72-75 - Target must have SSH service accessible on the configured SSHPORT (default 22).
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:86 - DefangedMode must be set to false to allow the module to change the root password.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229
Observed behavior
- Mints a pre-auth session by sending a POST request to /login with random credentials and extracting the whostmgrsession cookie.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:95-112 - Injects session fields (user=root, hasroot=1, etc.) via a CRLF injection in the Basic-auth password, bypassing the encoder by omitting the ob-part of the session cookie.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134 - Promotes the injected fields into the authoritative session cache by requesting /scripts2/listaccts.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:136-146 - Verifies root WHM access by retrying a request to /json-api/version until a 200 response with version data is received.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:148-160 - Sets a temporary root password via the WHM JSON API passwd endpoint.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278 - Establishes an SSH connection as root using the temporary password and opens a command shell session.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-301 - Rotates the root password to a new random value after the SSH session is established.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:306-330 - Stores the rotated root credential in the Metasploit database.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:335-352
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module injects session fields via a crafted Basic-auth header to gain unauthorized root access, which is the core of the documented CVE-2026-41940 exploit.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:114-134 - Exploit Behavior
- Payload withheldThe module uses the passwd API endpoint to set a temporary root password for SSH access, as described in the module's description.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:255-278 - Exploit Behavior
- Payload withheldAfter setting the temporary password, the module connects via SSH, establishes a command stream, and rotates the root password to a new random value, as described.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:280-355 - Safety Mechanism
- Payload withheldThe module includes a DefangedMode option (default true) that must be explicitly set to false to proceed, preventing unintended password changes.
modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:90modules/exploits/multi/http/cpanel_whm_auth_bypass_rce.rb:223-229
What the analysis did not establish
- Analysis is based on module source code and metadata only; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The module's actual runtime behavior, reliability, and safety are not verified by execution.
- Review is limited to the module source code and metadata; framework mixins, libraries, and external payloads are not expanded or analyzed.
- Binary files are flagged as metadata-only and not analyzed, but no binary files are present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.