FreePBX firmware file upload
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit exploit module that chains CVE-2025-66039 (authentication bypass) and CVE-2025-61678 (authenticated arbitrary file upload) to achieve unauthenticated remote code execution on FreePBX by uploading a PHP webshell.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2025-66039 and CVE-2025-61678. It performs authentication bypass and file upload to deliver a user-chosen payload. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that chains two CVEs to bypass authentication, upload a PHP webshell, and execute it for remote code execution. It includes check, auth bypass, upload, and trigger methods, and is classified as 'exploit' in its own metadata.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:6modules/exploits/unix/http/freepbx_firmware_file_upload.rb:126-137Requirements
- FreePBX target with Webserver Authorization Mode enabled and vulnerable versions (prior to 16.0.44/17.0.23 for auth bypass; prior to 16.0.92/17.0.6 for file upload).
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:18 - A valid FreePBX username must be supplied via the USERNAME option.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:54
Observed behavior
- Sends a GET request to /admin/config.php to check if the target returns a 401 with 'FreePBX' in the body or a 500, indicating Webserver authentication mode is active.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:60-68 - Bypasses authentication by sending a GET request to /admin/config.php with a forged Authorization header containing the supplied username and a random password, then extracts the session cookie from the 401 response.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:73-84 - Uploads a PHP payload via a multipart POST request to /admin/ajax.php?module=endpoint&command=upload_cust_fw, using path traversal in the fwbrand parameter to place the webshell in a web-accessible directory.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:86-117 - Triggers the uploaded PHP payload by sending a GET request to the webshell's URL.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:119-124
Behaviors behind the backdoor verdict
Observables
- Payload Delivery
- payload.encodedThe module uploads and executes a user-supplied payload, which is standard exploit behavior.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:94-101 - Authentication Bypass
- basic_auth with random passwordThe module uses a forged Authorization header to bypass authentication, consistent with CVE-2025-66039.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:77 - Path Traversal
- ../../../var/www/html/The module uses path traversal in the fwbrand parameter to place the webshell in the web root, consistent with CVE-2025-61678.
modules/exploits/unix/http/freepbx_firmware_file_upload.rb:98
What the analysis did not establish
- Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of payload.encoded and helper methods (e.g., basic_auth, send_request_cgi) is not visible.
- The evidence does not include any runtime output, network captures, or verification that the exploit succeeds against a live target.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads were not expanded or analyzed.
- Binary files were flagged as metadata-only and not inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.