HUSTOJ Zip-Slip v26.01.24 - RCE

ExploitDBExploitDB exploitExploitEDB-52539

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-24479, a Zip-Slip vulnerability in HUSTOJ. It authenticates as an admin, uploads a crafted ZIP archive containing path traversal sequences to write a PHP shell and an ELF payload to the web root and /tmp, then triggers the PHP shell to execute the payload, achieving remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied Metasploit module implements a documented Zip-Slip RCE exploit for CVE-2026-24479. It authenticates to a HUSTOJ instance, uploads a crafted ZIP containing a Metasploit-generated payload and PHP caller, and triggers execution. All actions are consistent with the stated exploit purpose; no concealed backdoor, unrelated payload, or operator-directed harm is observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesRuby
Target softwareHUSTOJ
Attack typesRemote Code ExecutionPath TraversalZip Slip
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit module that actively exploits CVE-2026-24479 by authenticating, uploading a crafted ZIP with path traversal to write a PHP shell and ELF payload, and triggering the shell to execute the payload for remote code execution. It is not a scanner, writeup, or stub.

exploits/multiple/webapps/52539.rb:1-371

Requirements

  • Valid administrative credentials for the HUSTOJ target.exploits/multiple/webapps/52539.rb:105-106
  • Target HUSTOJ version prior to 26.01.24.exploits/multiple/webapps/52539.rb:85

Observed behavior

  • Authenticates to the HUSTOJ web application using provided admin credentials.exploits/multiple/webapps/52539.rb:138-222
  • Generates an ELF payload (e.g., Meterpreter reverse TCP) and a PHP shell caller script.exploits/multiple/webapps/52539.rb:328-349
  • Creates a malicious ZIP archive containing files with directory traversal sequences (e.g., ../../tmp/...) to write the ELF payload and PHP shell outside the intended extraction directory.exploits/multiple/webapps/52539.rb:350-361
  • Uploads the malicious ZIP archive via a multipart POST request to /admin/problem_import_qduoj.php.exploits/multiple/webapps/52539.rb:225-296
  • Triggers the dropped PHP shell by sending a GET request to the web root, which executes the ELF payload and establishes a reverse shell.exploits/multiple/webapps/52539.rb:299-309
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Authenticated Zip-Slip RCE via crafted ZIP uploadThe module logs in as admin, uploads a ZIP with path traversal to write a PHP shell and ELF payload, then triggers the shell. This matches the CVE description and module purpose.exploits/multiple/webapps/52539.rb:326-370
Payload Generation
Uses Metasploit framework to generate payload from user-specified moduleThe exploit generates the payload via framework.modules.create and generate_simple, using user-supplied LHOST/LPORT. No hardcoded backdoor payload is present.exploits/multiple/webapps/52539.rb:328-338
Cleanup Mechanism
Drops a cleanup PHP script to remove uploaded filesThe module includes a cleanup_caller PHP script that deletes the dropped ELF and PHP files, and a cleanup method that triggers it. This is a standard post-exploitation cleanup, not a backdoor.exploits/multiple/webapps/52539.rb:312-323exploits/multiple/webapps/52539.rb:348-349
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the supplied Metasploit module source code; no external dependencies, libraries, or referenced resources were expanded or analyzed.
  • The artifact's behavior is inferred from static code analysis; the code was not executed, and its operational reliability or safety is not assessed.
  • Only the Metasploit module source code was reviewed; the generated payload binary and the Metasploit framework's internal payload generation are not included in the evidence.
  • The review does not assess the safety or reliability of the exploit against legitimate targets.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1