Generic HTTP Command Execution
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
This is a Metasploit exploit module that sends a user-supplied command payload to a vulnerable HTTP endpoint. It substitutes a placeholder in the URI or POST data with the encoded payload and sends the request to achieve remote command execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a generic HTTP command execution exploit. It sends user-supplied payloads via GET or POST requests to a configurable URI, which is consistent with its documented purpose. No concealed executable behavior, credential theft, persistence mechanisms, or unrelated payloads were observed. The module's actions are entirely controlled by the operator through standard Metasploit datastore options.
Classification basis and observed behavior
Classification basis
The module's exploit method sends a command payload to a target endpoint, which is the defining characteristic of an exploit. It is not merely a scanner because it actively delivers a payload to execute commands on the target system.
modules/exploits/multi/http/os_cmd_exec.rb:141-144Requirements
- A target HTTP endpoint that passes user-supplied input to a system command execution function (e.g., a webshell or vulnerable application).
modules/exploits/multi/http/os_cmd_exec.rb:18-20
Observed behavior
- The module sends an HTTP request (GET or POST) to a configurable URI, replacing the '!INJECT!' placeholder with the encoded command payload.
modules/exploits/multi/http/os_cmd_exec.rb:141-144 - The check method sends an 'echo' command with a random string and verifies if the response body contains that string to confirm vulnerability.
modules/exploits/multi/http/os_cmd_exec.rb:124-135
Behaviors behind the backdoor verdict
Observables
- Module Purpose
- Generic HTTP Command ExecutionThe module is designed to interact with existing command execution functionality on a target system by passing user-supplied input to system execution functions via HTTP requests.
modules/exploits/multi/http/os_cmd_exec.rb:17-19 - Payload Delivery
- Operator-supplied payload injected into URI or POST dataThe exploit substitutes the placeholder '!INJECT!' in the configured URIPATH or POSTDATA with the operator's chosen payload, which is standard Metasploit behavior.
modules/exploits/multi/http/os_cmd_exec.rb:143-144 - Operator Control
- All actions driven by datastore options (URIPATH, POSTDATA, HEADERS)The module does not perform any autonomous actions; it relies entirely on operator-provided parameters to construct and send HTTP requests.
modules/exploits/multi/http/os_cmd_exec.rb:74-80
What the analysis did not establish
- Only the module source code and metadata are provided; framework mixins, libraries, and external payloads are not expanded, so the full execution context is not visible.
- The evidence does not include any runtime output or confirmation that the exploit was successfully executed against a target.
- Review is limited to the provided module source code (os_cmd_exec.rb). The behavior of included Metasploit mixins (e.g., Msf::Exploit::Remote::HttpClient, Msf::Exploit::Remote::AutoCheck) and the framework's payload handling are not expanded or analyzed.
- The analysis scope explicitly states that framework mixins, libraries, and external payloads are not expanded, so any backdoor behavior within those components would not be detected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Linked vulnerabilities
0This PoC is retained in the catalog but is not currently linked to a vulnerability.