Valentin Lobstein <chocapikk@leakix.net>

Classification basis

The module is a complete Metasploit exploit that includes authentication, version checking, and a command injection mechanism to execute arbitrary payloads on the target. It is classified as 'exploit' because its primary purpose is to gain remote code execution, not merely detect the vulnerability.

Requirements

• Valid FreePBX credentials for a user in the 'Filestore' groupmodules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:36-38
• Target running vulnerable filestore module version (>= 17.0.2.36, < 17.0.3)modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:35-36

Observed behavior

• Authenticates to FreePBX using provided username and passwordmodules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:123-132
• Checks if target is vulnerable by retrieving and comparing filestore module versionmodules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:88-111
• Sends POST request to /admin/ajax.php with command injection payload in 'key' parameter using $(cmd) syntaxmodules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:158-181
• Executes attacker-supplied payload (e.g., reverse shell) on the target systemmodules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:113-121

Observables

Exploit Behavior

Payload withheldThis is the documented exploit mechanism for CVE-2025-64328.modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:161-180

Payload Execution

Payload withheldThis is the standard Metasploit pattern for delivering the user-chosen payload.modules/exploits/unix/http/freepbx_filestore_cmd_injection.rb:113-116

Classification basis

The module actively exploits the SQL injection vulnerability by sending crafted payloads to extract data from the database, which constitutes exploitation rather than mere scanning or detection.

Requirements

• Target running AVideo <= 22.0 with vulnerable objects/videos.json.php endpointmodules/auxiliary/gather/avideo_catname_sqli.rb:18-19

Observed behavior

• Sends a JSON POST request with a malicious catName parameter containing a time-based blind SQL injection payload using BENCHMARK()modules/auxiliary/gather/avideo_catname_sqli.rb:133-141
• Dumps usernames and password hashes from the users table via blind SQL injectionmodules/auxiliary/gather/avideo_catname_sqli.rb:82-86
• Stores extracted credentials as loot and creates credential objects in the Metasploit databasemodules/auxiliary/gather/avideo_catname_sqli.rb:99-119

Observables

Credential Extraction

Payload withheldThis is the declared purpose of the module and is performed using the Metasploit SQLi library's dump_table_fields method.modules/auxiliary/gather/avideo_catname_sqli.rb:82-86

Data Exfiltration

Payload withheldStandard Metasploit reporting behavior for credential-gathering modules; no external exfiltration is performed.modules/auxiliary/gather/avideo_catname_sqli.rb:99-119

Vulnerability Exploitation

Payload withheldThe payload uses BENCHMARK() to induce delays for data extraction, matching the described technique for bypassing prepared statement restrictions.modules/auxiliary/gather/avideo_catname_sqli.rb:133-141

Classification basis

The module is a fully functional exploit that sends a malicious request to execute arbitrary OS commands on the target. It includes both a check method for vulnerability detection and an exploit method that delivers a payload for command execution.

Requirements

• Target must be running a vulnerable version of AVideo Encoder (< 7.0) with the getImage.php endpoint accessible.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:18-19

Observed behavior

• Sends a GET request to payload withheld with a base64Url parameter containing a base64-encoded URL and an injected shell command.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:105-110
• The check method confirms vulnerability by measuring response time after injecting sleep commands.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:75-98
• The exploit method sends the Metasploit payload encoded as a command, replacing spaces with ${IFS}.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:100-103

Observables

Command Injection Payload

Payload withheldThe exploit method substitutes spaces in the Metasploit payload with ${IFS} to avoid shell parsing issues, a standard technique for command injection exploits.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:102

Exploit Target Endpoint

Payload withheldThe module targets the vulnerable endpoint described in the CVE, sending a crafted base64Url parameter containing a command injection.modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb:107-109

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by sending a malicious email, locating the resulting .htaccess file, and executing arbitrary code on the target. It includes all necessary logic for exploitation: email construction with ZWSP bypass, cron wait, file discovery, and payload delivery.

Requirements

• A valid mailbox email address for the target FreeScout instance.modules/exploits/multi/http/freescout_htaccess_rce.rb:40-41
• Web-accessible attachment storage (storage:link pointing to storage/app/).modules/exploits/multi/http/freescout_htaccess_rce.rb:40-41
• SMTP access to send the exploit email.modules/exploits/multi/http/freescout_htaccess_rce.rb:139-140

Observed behavior

• Sends a crafted email via SMTP with a .htaccess attachment whose filename is prefixed with a zero-width space (U+200B) to bypass the sanitizeUploadedFileName() check.modules/exploits/multi/http/freescout_htaccess_rce.rb:15modules/exploits/multi/http/freescout_htaccess_rce.rb:192
• Waits for the FreeScout cron job to fetch the email, strip the ZWSP, and store the .htaccess file in the attachment directory.modules/exploits/multi/http/freescout_htaccess_rce.rb:196-206
• Scans the attachment storage directory structure to locate the uploaded .htaccess file by checking for a unique marker embedded in its content.modules/exploits/multi/http/freescout_htaccess_rce.rb:222-234
• Triggers remote code execution by sending an HTTP request to the discovered .htaccess file, which is configured with SetHandler to execute as PHP.modules/exploits/multi/http/freescout_htaccess_rce.rb:17-22modules/exploits/multi/http/freescout_htaccess_rce.rb:149-153
• Supports multiple payload types including PHP in-memory, command shells, and droppers for Linux and Windows.modules/exploits/multi/http/freescout_htaccess_rce.rb:58-99

Observables

Exploit Mechanism

Payload withheldThe module exploits a TOCTOU vulnerability in FreeScout's filename sanitization to upload a .htaccess file that enables PHP execution.modules/exploits/multi/http/freescout_htaccess_rce.rb:15-22modules/exploits/multi/http/freescout_htaccess_rce.rb:191-192

Payload Delivery

Payload withheldThe .htaccess file contains a PHP gate that restricts execution to POST requests and includes a self-deletion mechanism triggered by a cleanup parameter.modules/exploits/multi/http/freescout_htaccess_rce.rb:171-182

Cleanup Mechanism

Payload withheldThe cleanup method sends a POST request to the shell URI with a random cleanup parameter, causing the PHP code to unlink itself.modules/exploits/multi/http/freescout_htaccess_rce.rb:156-167modules/exploits/multi/http/freescout_htaccess_rce.rb:172

Network Behavior

Payload withheldThe module scans predictable attachment storage paths to find the uploaded .htaccess file by checking for a unique marker, then sends POST requests to execute commands.modules/exploits/multi/http/freescout_htaccess_rce.rb:222-234modules/exploits/multi/http/freescout_htaccess_rce.rb:241-248

Classification basis

The artifact is a complete Metasploit exploit module that chains SQL injection to OS command injection for remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects malicious SQL to overwrite a configuration value, then triggers command execution via a separate endpoint. The module delivers payloads (command shell or dropper) and includes cleanup logic.

Requirements

• Target must be running a vulnerable version of openDCIM (23.04 through 25.01) with install.php accessible.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:19-31
• The install.php endpoint must accept POST requests with ldapaction=Set and process LDAP configuration parameters without authentication.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:108-112

Observed behavior

• Sends a GET request to install.php to check if the endpoint is accessible and appears to be openDCIM.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:92-101
• Performs three time-based SQL injection tests by sending POST requests with a SLEEP() payload in a random LDAP field and measuring response time.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:103-116
• Creates a backup table of the current LDAP and dot configuration values from fac_Config using a stacked SQL query.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:175-179
• Injects a stacked SQL UPDATE query to overwrite the dot parameter in fac_Config with the attacker-supplied command.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:182-185
• Triggers execution of the poisoned dot value by sending a GET request to report_network_map.php, which calls exec() with the database value.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:194-201
• Restores the original configuration from the backup table and drops the backup table after exploitation.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:188-191

Observables

Exploit Chain

Payload withheldThe module's exploit method uses inject_sql to poison the dot configuration parameter and trigger_dot to request report_network_map.php, which is the documented OS command injection vector.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:121-141modules/exploits/linux/http/opendcim_install_sqli_rce.rb:182-186modules/exploits/linux/http/opendcim_install_sqli_rce.rb:194-202

Configuration Restoration

Payload withheldThe backup_config method creates a backup table, and restore_config restores original values and drops the backup table. This is consistent with the module's stated goal of being crash-safe and minimizing side effects.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:148-155modules/exploits/linux/http/opendcim_install_sqli_rce.rb:175-180modules/exploits/linux/http/opendcim_install_sqli_rce.rb:188-192

Payload Delivery

Payload withheldThe exploit method uses payload.encoded for the :cmd target and execute_cmdstager for the :dropper target, both standard Metasploit patterns for delivering operator-chosen payloads.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:127-133modules/exploits/linux/http/opendcim_install_sqli_rce.rb:138-141

Classification basis

The module is a complete Metasploit exploit that actively exercises the vulnerability to achieve remote code execution. It includes authentication, version checking, SSTI payload generation, and payload delivery for multiple target architectures.

Requirements

• Valid Tactical RMM credentials with Report Viewer or Report Manager permissionsmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:26
• Target running Tactical RMM version prior to 1.4.0modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:19-20

Observed behavior

• Authenticates to the Tactical RMM API using provided credentials to obtain a Knox tokenmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:118-132
• Sends a POST request to the /reporting/templates/preview/ endpoint with a Jinja2 SSTI payload in the template_md parametermodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:141-158
• The SSTI payload uses Jinja2 to access Python builtins and execute arbitrary code via threading and execmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:200-204
• Delivers a Metasploit payload (Python, Unix command, or Linux x64 ELF) for remote code executionmodules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:213-228

Observables

Exploit Mechanism

Payload withheldThe module sends a Jinja2 expression to the /reporting/templates/preview/ endpoint to achieve remote code execution.modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:200-204

Payload Delivery

Payload withheldThe exploit supports three target types, delivering the selected Metasploit payload through the SSTI vulnerability.modules/exploits/linux/http/tacticalrmm_ssti_rce_cve_2025_69516.rb:213-228

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises CVE-2024-37032 to achieve remote code execution. It includes all steps: starting a rogue registry, crafting path traversal payloads, writing files, and triggering execution.

Requirements

• Target must be running a vulnerable version of Ollama (before 0.1.34) with the API accessible.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:24-25modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:38-39
• Attacker must be able to run a rogue OCI registry reachable by the target.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:29-30modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:168-170

Observed behavior

• Starts a rogue OCI registry server to serve malicious model manifests and blobs.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:168-170
• Sends a POST request to /api/pull to trigger the target to pull a model containing path traversal sequences in layer digests, writing a malicious shared library and /etc/ld.so.preload.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:251-258modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:235-241
• Sends a second POST to /api/pull to register a valid trigger model, then uses /api/chat to spawn the llama.cpp runner process, which loads the malicious library via ld.so.preload, executing the payload.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:279-285modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:300-309
• The generated shared library constructor forks, cleans up /etc/ld.so.preload, and executes the Metasploit payload in the child process.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:127-150

Observables

Payload Generation

Payload withheldThe module uses the standard Metasploit payload generation mechanism to create shellcode, which is then embedded in a shared library. This is normal exploit behavior.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:128

File Cleanup

Payload withheldThe module registers the modified ld.so.preload file for cleanup, indicating an attempt to restore the target system after exploitation.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:275

Model Cleanup

Payload withheldThe module deletes the trigger model after exploitation, which is a cleanup step consistent with the documented exploit flow.modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb:311

Classification basis

The module is a complete Metasploit exploit that includes check and exploit methods, constructs malicious HTTP requests to create browser sessions with payloads, and executes arbitrary commands on the target. It is classified as exploit because it actively exercises the vulnerability to achieve remote code execution.

Requirements

• Target must be running Selenium Grid or Selenoid without authenticationmodules/exploits/linux/http/selenium_greed_rce.rb:25-26
• Target must have Chrome (unpatched Grid <4.11.0 or Selenoid) or Firefox availablemodules/exploits/linux/http/selenium_greed_rce.rb:29-38

Observed behavior

• Detects backend type (Selenium Grid or Selenoid) by querying status endpointsmodules/exploits/linux/http/selenium_greed_rce.rb:148-161
• Enumerates available browsers from backend metadatamodules/exploits/linux/http/selenium_greed_rce.rb:163-182
• For Chrome, sends a session creation request with goog:chromeOptions binary set to /usr/bin/python3 and args containing a Python payloadmodules/exploits/linux/http/selenium_greed_rce.rb:227-235
• For Firefox, builds a malicious profile ZIP with handlers.json mapping application/sh to /bin/sh, creates a session, and navigates to a data: URI to trigger shell executionmodules/exploits/linux/http/selenium_greed_rce.rb:260-303
• Cleans up created sessions after exploitationmodules/exploits/linux/http/selenium_greed_rce.rb:220-225

Observables

Exploit Technique

Payload withheldThe module sets the Chrome binary to /usr/bin/python3 with attacker-controlled arguments to execute a payload.modules/exploits/linux/http/selenium_greed_rce.rb:232

Exploit Technique

Payload withheldThe module creates a malicious Firefox profile that maps application/sh to /bin/sh, then navigates to a data: URI to trigger shell execution.modules/exploits/linux/http/selenium_greed_rce.rb:294-303

Payload Delivery

Payload withheldThe module uses payload.encoded and Msf::Payload::Python mixin to deliver attacker-chosen payloads, consistent with normal Metasploit exploit behavior.modules/exploits/linux/http/selenium_greed_rce.rb:256modules/exploits/linux/http/selenium_greed_rce.rb:275

Classification basis

The module's exploit method constructs and sends a malicious HTTP POST request containing PHP code in the _anciennes_valeurs parameter, which is designed to be executed by the target server, achieving remote code execution.

Requirements

• Target must be running SPIP with the Saisies plugin version 5.4.0 through 5.11.0.modules/exploits/multi/http/spip_saisies_rce.rb:34
• A publicly accessible page containing a saisies-powered form must exist.modules/exploits/multi/http/spip_saisies_rce.rb:28-29

Observed behavior

• Sends an HTTP POST request with a crafted _anciennes_valeurs parameter containing PHP code to execute arbitrary commands on the server.modules/exploits/multi/http/spip_saisies_rce.rb:231-239
• Optionally crawls the target SPIP site starting from the sitemap to automatically discover a page with a saisies form.modules/exploits/multi/http/spip_saisies_rce.rb:134-180
• Performs a version check of the Saisies plugin to determine if the target is vulnerable.modules/exploits/multi/http/spip_saisies_rce.rb:89-104

Observables

Exploit Behavior

Payload withheldThis is the documented exploit mechanism for payload withheld. The payload is base64-encoded and injected into a hidden field rendered with interdire_scripts=false.modules/exploits/multi/http/spip_saisies_rce.rb:228-239

Target Platforms

Payload withheldThe module supports PHP in-memory, Unix/Linux command shell, and Windows command shell targets, consistent with a legitimate RCE exploit.modules/exploits/multi/http/spip_saisies_rce.rb:46-68

Cve Reference

Payload withheldThe module references a known CVE for the SPIP Saisies plugin RCE vulnerability, aligning with the described exploit.modules/exploits/multi/http/spip_saisies_rce.rb:42

Classification basis

The artifact is a complete Metasploit exploit module that actively delivers a payload to achieve remote code execution. The exploit method constructs and sends a malicious request to execute arbitrary PHP code on the target.

Requirements

• Target must be running a vulnerable version of MajorDoMo (all versions up to and including latest release).modules/exploits/multi/http/majordomo_console_eval_rce.rb:32-33
• The /admin.php endpoint must be reachable and return HTTP 200.modules/exploits/multi/http/majordomo_console_eval_rce.rb:90-95

Observed behavior

• Sends a GET request to /admin.php with parameters ajax_panel=1, op=console, and command containing a base64-encoded PHP payload to be executed via eval().modules/exploits/multi/http/majordomo_console_eval_rce.rb:117-131
• Performs a vulnerability check by sending a GET request with a unique marker in the command parameter and verifying its presence in the response body.modules/exploits/multi/http/majordomo_console_eval_rce.rb:98-111

Observables

Exploit Mechanism

Payload withheldThis is the documented vulnerability exploitation path for CVE-2026-27174, matching the module description and CVE record.modules/exploits/multi/http/majordomo_console_eval_rce.rb:99-107modules/exploits/multi/http/majordomo_console_eval_rce.rb:118-131

Payload Delivery

Payload withheldStandard Metasploit payload delivery pattern; no hardcoded or unrelated payload is injected.modules/exploits/multi/http/majordomo_console_eval_rce.rb:118-120

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by sending malicious requests, serving a payload, and executing it on the target to achieve remote code execution.

Requirements

• Target must be running a vulnerable version of MajorDoMo with the saverestore module accessible.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:24-28
• Attacker's HTTP server (SRVHOST) must be reachable from the target to serve the Atom feed and tarball.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:234modules/exploits/multi/http/majordomo_supply_chain_rce.rb:248

Observed behavior

• Sends a GET request to /objects/?module=saverestore&mode=auto_update_settings&set_update_url=<attacker_url> to poison the MASTER_UPDATE_URL.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:168-176
• Sends a GET request to /objects/?module=saverestore&mode=force_update to trigger the update process.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:179-188
• Starts an HTTP server that serves a crafted Atom feed and a malicious tarball containing a PHP webshell.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:211-232
• Waits for the target to fetch the feed and tarball, then sends a GET request to the deployed webshell to execute the payload.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:240-256

Observables

Exploit Flow

Payload withheldThe module implements the documented exploit chain: poison_update_url sets the MASTER_UPDATE_URL (lines 166-177), trigger_update initiates the update (lines 179-189), and execute_webshell triggers the deployed payload (lines 191-197).modules/exploits/multi/http/majordomo_supply_chain_rce.rb:166-197

Http Server

Payload withheldThe exploit method starts an HTTP server (lines 211-232) that serves a fake Atom feed and a tarball containing the Metasploit payload. This is necessary for the supply-chain attack and is not a backdoor.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:211-232

Payload Generation

Payload withheldThe module generates a PHP webshell containing the Metasploit payload (lines 200-202) and packages it into a tarball (lines 147-164). This is the standard Metasploit payload delivery mechanism.modules/exploits/multi/http/majordomo_supply_chain_rce.rb:200-202modules/exploits/multi/http/majordomo_supply_chain_rce.rb:147-164

Classification basis

The module's exploit method injects a payload via command substitution into the 'param' parameter, which is executed by the cycle_execs.php worker, achieving remote code execution. This is the primary purpose of the code.

Requirements

• Target must be running a vulnerable version of MajorDoMo with rc/index.php and cycle_execs.php accessible without authentication.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:19-28
• A valid .bat file name (e.g., shutdown) must exist in rc/commands/.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:30-31

Observed behavior

• Sends a GET request to rc/index.php with a command parameter to check vulnerability.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:84-88
• Sends a GET request to cycle_execs.php to verify it is accessible without authentication.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:95-98
• Bootstraps database tables by requesting cycle.php in a background thread.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:112-118
• Starts the cycle_execs.php worker in a background thread to purge the queue and enter a polling loop.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:124-130
• Injects the payload via the 'param' parameter in a GET request to rc/index.php, using command substitution syntax.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:137-144
• Waits for the worker to poll the database and execute the injected command.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:150-151

Observables

Payload Injection

Payload withheldThe module injects the user-supplied Metasploit payload into the 'param' parameter, which is the core exploit mechanism.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:142

File Cleanup

Payload withheldThe module registers a 'reboot' file for cleanup, which is a standard Metasploit FileDropper mixin call to remove artifacts left by the exploit.modules/exploits/multi/http/majordomo_cmd_injection_rce.rb:147

Classification basis

The module actively sends crafted requests to exploit a path traversal vulnerability and retrieve file contents, which constitutes exploitation rather than mere scanning or detection.

Requirements

• Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.10.10408.56683).modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:27-28
• The /storage/t.dn endpoint must be accessible and accept the 's' parameter with traversal sequences.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:22-23

Observed behavior

• Sends an HTTP GET request to /storage/t.dn with a path traversal payload in the 's' parameter to read an arbitrary file.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77
• If the response status is 200, the file content is returned and stored as loot.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:89-96
• The EXTRACT_MACHINEKEY action reads Web.config and extracts the machineKey for use in ViewState deserialization attacks.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-148

Observables

Exploit Behavior

Payload withheldThe module sends a GET request with a traversal path in the 's' parameter to read arbitrary files, matching the described vulnerability.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:68-77

File Read

Payload withheldThe EXTRACT_MACHINEKEY action reads a file and passes content to handle_machinekey_extraction, which is a standard Metasploit mixin for extracting cryptographic keys.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:128-149

Loot Storage

Payload withheldThe module uses store_loot to save the retrieved file, which is normal Metasploit behavior for auxiliary/gather modules.modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb:116-125

Classification basis

The module actively forges cryptographic tickets to read arbitrary files from a remote server, which constitutes exploitation of the hardcoded key vulnerability (CVE-2025-14611). It does not merely detect or scan; it performs the unauthorized action of file retrieval.

Requirements

• Target must be running a vulnerable version of Gladinet CentreStack or Triofox (up to 16.12.10420.56791).modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:42-43
• The hardcoded AES keys (SysKey and SysKey1) must match those used by the target application.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:14-21

Observed behavior

• Constructs a plaintext ticket containing a filepath, empty username/password, and a far-future timestamp.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:110-113
• Encrypts the ticket using AES-256-CBC with hardcoded keys and encodes it in a URL-safe Base64 variant.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:125-131
• Sends an HTTP GET request to the /storage/filesvr.dn or /servlets/filesvr.dn endpoint with the forged ticket as a query parameter.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174
• If the response is 200, the file content is returned and stored as loot; the module can also parse the Web.config to extract the machineKey.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:176-192modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:225-251

Observables

Hardcoded Key

Payload withheldHardcoded cryptographic keys extracted from the vulnerable DLL are used to forge access tickets, which is the core of the exploit.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:20-21

Network Request

Payload withheldThe module sends a crafted HTTP request to the target to read arbitrary files, which is the intended exploit behavior.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:170-174

Data Exfiltration

Payload withheldThe module saves the retrieved file content to the local Metasploit loot directory, which is standard auxiliary module behavior.modules/auxiliary/gather/gladinet_storage_access_ticket_forge.rb:214-222

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by discovering the salt, encrypting a payload, and sending it to the target to achieve remote code execution. It includes check and exploit methods, payload generation, and session handling.

Requirements

• Target must be running AVideo version 14.3.1 or later but prior to 20.1.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:47-50
• The notify.ffmpeg.json.php endpoint must be present and accessible.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:193-198
• The categories.json.php endpoint must be accessible to leak the installation timestamp.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:121
• A video hashId must be obtainable from videosAndroid.json.php or get.json.php.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:122

Observed behavior

• Gathers target information including version, endpoint availability, installation timestamps, and video hashId.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:162-175
• Performs an offline brute-force attack on the 5-character microsecond portion of the salt using the leaked timestamp and hashId.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:389-409
• Encrypts a PHP or command shell payload using the recovered salt and system root path, then sends it to the notify.ffmpeg.json.php endpoint for server-side eval().modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:131-148modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:427-454

Observables

Exploit Chain

Payload withheldThe module follows the documented exploit chain: leak timestamps, leak hashId, bruteforce salt, encrypt payload, send to notify.ffmpeg.json.php. This is normal exploit behavior.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:35-41modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:131-148

Payload Execution

Payload withheldThe module encrypts a user-supplied payload and sends it to the target. The payload is standard Metasploit payloads (PHP in-memory, Unix/Linux command, Windows command). No hidden or unrelated payload is embedded.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:135-137modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:427-454

Author Contact

Payload withheldAuthor information is present in the module metadata. This is standard for Metasploit modules and does not indicate backdoor behavior.modules/exploits/multi/http/avideo_notify_ffmpeg_unauth_rce.rb:58-59

Classification basis

The artifact is a complete Metasploit exploit module that includes both a check method for vulnerability detection and an exploit method that delivers a payload to achieve remote code execution.

Requirements

• Target must be running a vulnerable version of Web-Check (< 2.0.1) with the /api/screenshot endpoint exposed.modules/exploits/multi/http/web_check_screenshot_rce.rb:20-23

Observed behavior

• The check method sends sleep commands of varying durations and measures response time to confirm command injection.modules/exploits/multi/http/web_check_screenshot_rce.rb:100-131
• The exploit method sends the encoded payload as a command injection via the url parameter to the /api/screenshot endpoint.modules/exploits/multi/http/web_check_screenshot_rce.rb:133-136
• The build_url method constructs a malicious URL with a command injection payload in a query parameter.modules/exploits/multi/http/web_check_screenshot_rce.rb:84-89

Observables

Command Injection Vector

Payload withheldThe module constructs a malicious URL with a shell command injected into a query parameter value, which is then sent to the /api/screenshot endpoint to exploit CVE-2025-32778.modules/exploits/multi/http/web_check_screenshot_rce.rb:88modules/exploits/multi/http/web_check_screenshot_rce.rb:96

Vulnerability Check Method

Payload withheldThe check method sends sleep commands of varying durations and measures response time to confirm command injection without executing a payload.modules/exploits/multi/http/web_check_screenshot_rce.rb:110-117

Payload Delivery

Payload withheldThe exploit method sends the attacker-chosen payload via the same injection vector, which is standard Metasploit behavior.modules/exploits/multi/http/web_check_screenshot_rce.rb:133-135

Classification basis

The module actively sends a crafted XML payload to trigger an XXE vulnerability and reads arbitrary files from the target server, which constitutes exploitation, not just detection.

Requirements

• Target must be running a vulnerable GeoServer version (>= 2.26.0, <= 2.26.1 or <= 2.25.5) with the WMS endpoint accessible.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:17-23

Observed behavior

• Constructs an XXE payload with a randomized entity name that references a local file via file:// URI.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64
• Sends a POST request to the GeoServer WMS endpoint with the XXE payload as XML body.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:89-98
• Extracts the file content from the error message in the response using a regex on 'Unknown layer:'.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:81-87
• Stores the exfiltrated file content as loot in the Metasploit database.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:123-130

Observables

File Read

Payload withheldThe module reads an arbitrary file path supplied by the operator via the FILEPATH option, which is the intended exploit behavior for CVE-2025-58360.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:50modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:97

Xxe Payload

Payload withheldThe module constructs an XXE payload that defines an external entity pointing to a local file, which is the core of the documented vulnerability exploitation.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64

Loot Storage

Payload withheldThe retrieved file content is saved to the Metasploit loot database, which is standard behavior for auxiliary/gather modules.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:123-130

Classification basis

The module's primary purpose is to exploit CVE-2025-13486 by creating an admin user and deploying a payload for remote code execution. It includes complete exploit logic: nonce extraction, malicious request construction, admin creation, authentication, plugin upload, and payload execution.

Requirements

• A WordPress site with the vulnerable ACF Extended plugin (versions 0.9.0.5 through 0.9.1.1) and a page containing an ACF Extended form widget to expose the nonce token.modules/exploits/multi/http/wp_acf_extended_rce.rb:22-31

Observed behavior

• Sends a POST request to wp-admin/admin-ajax.php with action 'acfe/form/render_form_ajax' and form[render] set to 'wp_insert_user' to create a new WordPress administrator account.modules/exploits/multi/http/wp_acf_extended_rce.rb:128-144
• Logs in with the newly created administrator credentials, then uploads a malicious plugin ZIP file and triggers its execution by requesting the plugin's PHP file.modules/exploits/multi/http/wp_acf_extended_rce.rb:146-172

Observables

Exploit Mechanism

Payload withheldCore exploit step to create an administrator account, matching the vulnerability description.modules/exploits/multi/http/wp_acf_extended_rce.rb:137-141

Payload Deployment

Payload withheldStandard Metasploit post-auth RCE technique; the plugin is generated by the framework, not hardcoded.modules/exploits/multi/http/wp_acf_extended_rce.rb:162-171

Classification basis

The module is a complete Metasploit exploit that constructs and sends malicious HTTP requests to achieve remote code execution. It includes an 'exploit' method that executes a payload via child_process.exec, and is classified as an exploit module in its metadata.

Requirements

• Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with an exposed Server Function endpoint.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:37-40

Observed behavior

• Sends a POST request with a multipart/form-data body containing a malicious JSON chunk that uses '__proto__', 'constructor', or 'prototype' as module names to trigger prototype pollution during RSC payload deserialization.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:188-201modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:203-221
• Executes an arbitrary command payload on the target server by invoking child_process.exec with the attacker-supplied command.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:182-184
• Performs a vulnerability check for Next.js by sending a payload that triggers a redirect with a random ID, and for Waku by detecting framework markers in the response body.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:156-163modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:166-178

Observables

Exploit Behavior

Payload withheldThis is the documented exploit behavior for CVE-2025-55182. The module uses the Metasploit payload framework to deliver a command payload.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:184

Payload Execution

Payload withheldStandard Metasploit exploit pattern: the module executes the user-selected payload on the target. No additional hidden commands are injected.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:184

Check Method

Payload withheldCheck methods are non-destructive and only verify vulnerability presence. No backdoor behavior.modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:156-179

Classification basis

The artifact is a complete Metasploit exploit module that actively creates an administrator account and deploys a payload for remote code execution. It includes methods for registration, login, and payload upload/execution, which are characteristic of exploit code.

Requirements

• Target must be running WordPress with the King Addons for Elementor plugin (versions 24.12.92 to 51.1.14).modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:23
• A WordPress page containing the King Addons 'Login Register Form' Elementor widget must exist to expose the required nonce token.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:27-29

Observed behavior

• Sends a POST request to the WordPress admin-ajax endpoint with action 'king_addons_user_register' and 'user_role' set to 'administrator' to create a privileged account.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:160-173
• Logs in to WordPress with the newly created administrator credentials.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:107
• Generates a malicious plugin containing a payload, uploads it via the WordPress plugin upload functionality, and triggers execution by requesting the payload file.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:199-210

Observables

Exploit Behavior

Payload withheldCore exploit step matching the described CVE-2025-8489 privilege escalationmodules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:156-174

Exploit Behavior

Payload withheldStandard Metasploit post-authentication payload delivery via plugin uploadmodules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:107-114

Payload Delivery

Payload withheldPayload is generated by the framework, not hardcoded; no hidden second-stage downloadermodules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:199-210

Classification basis

The module's exploit method implements a complete attack chain that uploads a malicious file, triggers deserialization, and executes arbitrary code on the target, which is the definition of an exploit.

Requirements

• Target must be a Magento 2.x instance configured to use file-based session storage.modules/exploits/multi/http/magento_sessionreaper.rb:34-35
• Target must be unpatched (patched versions return 400 Bad Request).modules/exploits/multi/http/magento_sessionreaper.rb:35-36

Observed behavior

• Generates a Guzzle/FW1 deserialization payload containing a PHP stub that executes base64-decoded POST data.modules/exploits/multi/http/magento_sessionreaper.rb:134-136
• Uploads the malicious session file via an unauthenticated POST to /customer/address_file/upload.modules/exploits/multi/http/magento_sessionreaper.rb:168-185
• Triggers deserialization by sending a crafted JSON payload to /rest/default/V1/guest-carts/{cart_id}/order, which modifies the session savePath to point to the uploaded file.modules/exploits/multi/http/magento_sessionreaper.rb:219-232
• Executes the uploaded PHP code by sending a POST request with the base64-encoded payload to the uploaded PHP file.modules/exploits/multi/http/magento_sessionreaper.rb:151-161

Observables

Exploit Chain

Payload withheldThis is the documented exploit chain for CVE-2025-54236, consistent with the module description.modules/exploits/multi/http/magento_sessionreaper.rb:26-32

Payload Execution

Payload withheldThe module writes a PHP stub that evaluates a base64-decoded POST parameter, which is the standard Metasploit payload delivery mechanism.modules/exploits/multi/http/magento_sessionreaper.rb:135modules/exploits/multi/http/magento_sessionreaper.rb:154-161

File Cleanup

Payload withheldThe module registers artifacts for cleanup, which is normal Metasploit behavior and not indicative of persistence.modules/exploits/multi/http/magento_sessionreaper.rb:147-149

Classification basis

The artifact is a complete Metasploit exploit module that actively creates an administrator account and uploads a payload to execute arbitrary code on the target. It is not a scanner, writeup, or stub.

Requirements

• Target must be running WordPress with the AI Engine plugin version <= 3.1.3 and the MCP endpoint must expose a bearer token.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:25-27modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:92-96

Observed behavior

• Checks if the target is a vulnerable WordPress instance by verifying the AI Engine plugin version and extracting the MCP token from the REST API routes.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:89-98
• Creates a new WordPress administrator account via the MCP endpoint using the extracted token, or updates the password if the user already exists.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:111-117modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:251-258
• Logs in with the created administrator credentials, uploads a malicious plugin containing the payload, and triggers its execution to achieve remote code execution.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:119-126modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:277-289

Observables

Exploit Chain

Payload withheldThe module's exploit method (lines 101-127) first creates an admin user via the MCP API, then logs in and uploads a malicious plugin to execute a payload. This matches the stated description and CVE context.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:101-127

Payload Execution

Payload withheldThe upload_and_execute_payload method (lines 277-289) generates a plugin containing the payload, uploads it using the admin cookie, and triggers execution by requesting the payload file. This is standard Metasploit RCE behavior.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:277-289

Cleanup Registration

Payload withheldLines 284-285 register the uploaded plugin files and directory for cleanup, which is standard practice for Metasploit modules with side effects.modules/exploits/multi/http/wp_ai_engine_mcp_rce.rb:284-285

Classification basis

The module is a fully functional exploit that actively delivers and executes a payload on the target system. It includes code to start a malicious FTP server, trigger the vulnerable downloadFile action, serve a PHP payload, and execute it via HTTP.

Requirements

• Target must be running a vulnerable version of Monsta FTP (< 2.11.3).modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:22
• Attacker must be able to host an FTP server reachable by the target.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:238-239

Observed behavior

• Starts a malicious FTP server that authenticates any client with generated credentials.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:128-143
• Sends an HTTP POST request to the target's API to trigger the downloadFile action, instructing it to connect to the attacker's FTP server and download a PHP file.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:204-224
• Serves a PHP payload (meterpreter or command shell) when the target requests the file via FTP RETR.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:118-126
• Triggers execution of the uploaded PHP payload by sending an HTTP GET request to the payload's location on the target.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:245-246

Observables

Exploit Mechanism

Payload withheldThe module starts an FTP server (line 128-143) that serves a PHP payload (line 123) when the target connects and issues a RETR command. This matches the CVE description of arbitrary file upload from a malicious FTP server.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:128-143modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:118-126

Payload Generation

Payload withheldThe module generates a PHP payload using Metasploit's payload framework (line 92-95). For PHP targets, it uses the selected payload directly; for command targets, it wraps the command in a PHP exec call. This is standard exploit behavior.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:92-95

Http Trigger

Payload withheldThe module sends a crafted HTTP request to the target's API endpoint (line 208-224) to trigger the downloadFile action, causing the target to connect back to the attacker's FTP server and download the payload. This is the core exploit trigger.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:204-230

Cleanup Registration

Payload withheldThe module registers the uploaded payload file for cleanup (line 244), which is a standard Metasploit practice to remove artifacts after exploitation. This is not malicious behavior.modules/exploits/multi/http/monsta_ftp_downloadfile_rce.rb:244

Classification basis

The module is classified as a scanner because its primary purpose, as stated in its name ('Scanner'), description ('This module scans for vulnerable N-able N-Central instances'), and type ('auxiliary'), is to detect and report vulnerabilities. Although it performs actions that technically exploit the vulnerabilities (obtaining a session, reading a file via XXE), these actions serve the scanning goal of validating exposure and are not used for further post-exploitation impact. The module includes Msf::Auxiliary::Scanner and reports vulnerabilities, consistent with a scanner role.

Requirements

• Target must be running a vulnerable version of N-able N-Central (< 2025.4.0.9).modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:35
• Attacker must be able to reach the target's HTTP service and run a local HTTP/HTTPS server for DTD delivery.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:78-86

Observed behavior

• Sends a sessionHello SOAP request to /dms/services/ServerUI with appliance IDs from a configurable range to obtain an unauthenticated session ID.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:126-149
• If a session is obtained, writes a base64-encoded XXE payload to a log file via an applianceLogSubmit SOAP request to /dms/services/ServerMMS.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:233-248
• Triggers the XXE by calling importServiceTemplateFromFile on the written payload file, causing the target to fetch an attacker-hosted DTD and exfiltrate file contents via an error-based technique.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:250-260modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:338-350
• Reports vulnerabilities (CVE-2025-9316 and CVE-2025-11700) and stores exfiltrated file content as loot.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:113-120modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:194-203

Observables

Network Behavior

Payload withheldUsed to test for CVE-2025-9316 authentication bypass and to write/trigger XXE payload for CVE-2025-11700.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:136modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:242modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:259

Network Behavior

Payload withheldRequired for the error-based XXE technique to exfiltrate file contents from the target.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:78-86modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:338-349

File Operation

Payload withheldPart of the exploit chain for CVE-2025-11700; the payload is base64-encoded and written to a log file on the target.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:233-248

Data Exfiltration

Payload withheldThe module reads a user-specified file (default /etc/passwd) and stores it using store_loot, which is standard Metasploit behavior for captured data.modules/auxiliary/scanner/http/nable_ncentral_auth_bypass_xxe.rb:194

Classification basis

The module constructs and delivers a payload that executes arbitrary commands on the target via code injection, which is the definition of an exploit. It does not merely detect the vulnerability; it actively exploits it to achieve remote code execution.

Requirements

• Target must be running a vulnerable Flowise version (>= 2.2.7-patch.1 and < 3.0.6).modules/exploits/multi/http/flowise_js_rce.rb:19-20
• For versions < 3.0.1, authentication may not be required if FLOWISE_USERNAME and FLOWISE_PASSWORD are not set.modules/exploits/multi/http/flowise_js_rce.rb:23-25

Observed behavior

• Sends an HTTP request to the /api/v1/node-load-method/customMCP endpoint with a crafted mcpServerConfig parameter containing JavaScript code that uses child_process.exec to run an attacker-supplied command.modules/exploits/multi/http/flowise_js_rce.rb:120-135
• Executes a Metasploit payload (e.g., reverse shell) on the target system by passing payload.encoded to the execute_command method.modules/exploits/multi/http/flowise_js_rce.rb:138-140

Observables

Exploit Mechanism

Payload withheldThe module constructs a JavaScript payload that uses process.mainModule.require('child_process').exec() to run the attacker-chosen command, consistent with the described CVE-2025-59528 vulnerability.modules/exploits/multi/http/flowise_js_rce.rb:120-121

Target Behavior

Payload withheldThe exploit method calls execute_command(payload.encoded), which is standard Metasploit exploit behavior to deliver the user-selected payload.modules/exploits/multi/http/flowise_js_rce.rb:138-139