MajorDoMo Console Eval Unauthenticated RCE

MetasploitMetasploit exploitExploitRubyexploit_multi/http/majordomo_console_eval_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that exploits CVE-2026-27174, an unauthenticated remote code execution vulnerability in MajorDoMo. It sends a crafted GET request to /admin.php with ajax_panel, op, and command parameters to inject PHP code via eval().

Backdoor review

No backdoor observed in reviewed code

The Metasploit module exploits a documented CVE-2026-27174 vulnerability in MajorDoMo by sending a crafted GET request to trigger eval() on the target. The code performs only the expected exploit behavior: checking vulnerability presence and delivering a user-selected payload. No concealed, deceptive, or operator-directed harmful actions beyond the stated exploit are present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareMajorDoMo
Attack typescode injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively delivers a payload to achieve remote code execution. The exploit method constructs and sends a malicious request to execute arbitrary PHP code on the target.

modules/exploits/multi/http/majordomo_console_eval_rce.rb:117-131

Requirements

  • Target must be running a vulnerable version of MajorDoMo (all versions up to and including latest release).modules/exploits/multi/http/majordomo_console_eval_rce.rb:32-33
  • The /admin.php endpoint must be reachable and return HTTP 200.modules/exploits/multi/http/majordomo_console_eval_rce.rb:90-95

Observed behavior

  • Sends a GET request to /admin.php with parameters ajax_panel=1, op=console, and command containing a base64-encoded PHP payload to be executed via eval().modules/exploits/multi/http/majordomo_console_eval_rce.rb:117-131
  • Performs a vulnerability check by sending a GET request with a unique marker in the command parameter and verifying its presence in the response body.modules/exploits/multi/http/majordomo_console_eval_rce.rb:98-111
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Sends GET request to /admin.php with ajax_panel=1, op=console, and command parameter containing base64-encoded PHP payload passed to eval()This is the documented vulnerability exploitation path for CVE-2026-27174, matching the module description and CVE record.modules/exploits/multi/http/majordomo_console_eval_rce.rb:99-107modules/exploits/multi/http/majordomo_console_eval_rce.rb:118-131
Payload Delivery
Encodes user-selected payload in base64 and wraps it in eval(base64_decode(...))Standard Metasploit payload delivery pattern; no hardcoded or unrelated payload is injected.modules/exploits/multi/http/majordomo_console_eval_rce.rb:118-120
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The artifact is not executed; classification is based on static analysis of the provided Ruby code.
  • Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
  • Binary files were flagged as metadata-only and not inspected.
  • The review does not assess the safety or reliability of the exploit or its payloads.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1