NCR Command Center Agent Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_windows/misc/ncr_cmcagent_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2021-3122 by sending a crafted XML document containing a runCommand parameter to port 8089, enabling remote unauthenticated command execution as SYSTEM on NCR Command Center Agent 16.3.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2021-3122. It sends a crafted XML payload containing a PowerShell command to a target service on port 8089 to achieve remote code execution. No backdoor, deceptive payload, or concealed operator-directed harm is present. The code performs only the documented exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareNCR Command Center Agent
Attack typesremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method sends a crafted XML payload containing an attacker-supplied command to a vulnerable service, which is the core behavior of an exploit. The module is classified as 'exploit' in its metadata and includes code to deliver and execute a payload.

modules/exploits/windows/misc/ncr_cmcagent_rce.rb:113-129modules/exploits/windows/misc/ncr_cmcagent_rce.rb:6

Requirements

  • Target must be running NCR Command Center Agent 16.3 on port 8089.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:19-20

Observed behavior

  • Connects to the target on the configured RPORT (default 8089).modules/exploits/windows/misc/ncr_cmcagent_rce.rb:114
  • Generates a PowerShell command payload using cmd_psh_payload.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:117
  • Constructs an XML document containing the payload inside an <Arguments> element under a runCommand workitem.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:81-108
  • Sends the XML payload to the target over the TCP connection.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:122
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Sends XML with runCommand parameter to port 8089The module constructs an XML document containing a user-supplied payload command and sends it to the target service, consistent with the described vulnerability.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:81-108modules/exploits/windows/misc/ncr_cmcagent_rce.rb:113-122
Payload Generation
cmd_psh_payload with user-selected payloadThe exploit uses the standard Metasploit PowerShell payload generation mixin to create the command executed on the target. The payload is controlled by the operator, not hardcoded.modules/exploits/windows/misc/ncr_cmcagent_rce.rb:117
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact was not executed, and its behavior is inferred from static analysis of the Ruby source.
  • Analysis is limited to the module source code. Framework mixins (e.g., Msf::Exploit::Powershell, Msf::Exploit::Remote::Tcp) and the final payload are not expanded or reviewed. The module's behavior depends on those components, but the module itself shows no backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1