This module uses a relative path traversal vulnerability that leads to an authentication bypass in Fortinet FortiWeb to create a new user with administrative privileges (prof_admin) in the target system. First, the module will check if the target is vulnerable to the authentication bypass by checking the path traversal against a specific endpoint with an empty payload. If the target is vulnerable, the vulnerability will be used again to create a new user with administrative privileges (prof_admin) in the target system using the provided credentials. If no credentials are provided, the module will generate a random one. The new user credentials will be added as an identity in Impact.

This module uses a relative path traversal vulnerability that leads to an authentication bypass in Fortinet FortiWeb to create a new user with administrative privileges (prof_admin) in the target system. First, the module will check if the target is vulnerable to the authentication bypass by checking the path traversal against a specific endpoint with an empty payload. If the target is vulnerable, the vulnerability will be used again to create a new user with administrative privileges (prof_admin) in the target system using the provided credentials. If no credentials are provided, the module will generate a random one. The new user credentials will be added as an identity in Impact.

This module uses an insecure deserialization vulnerability in React Server Components to deploy an agent. The module will first check if the target is vulnerable by using the given endpoint with a generic payload. If the target is vulnerable, an OSCI agent will be deployed and the vulnerability will be used again, with a payload that will deploy an in-memory webshell. This webshell can be used later by the OSCI agent to execute OS commands or deploy a network agent. The deployed agent will run with the same privileges of the webapp.

The vulnerability exists within the GetCookie() endpoint due to unsafe deserialization of AuthorizationCookie objects. The application insecurely decrypts cookie data using AES-128-CBC and subsequently deserializes it via BinaryFormatter without sufficient type validation. The deployed agent will run with SYSTEM privileges. This exploit performs the following steps: Retrieves the ServerID via a SOAP request to the ReportingWebService. Obtains an authorization cookie. Obtains a reporting cookie. Constructs and sends a malicious event payload. Checks the server's response to confirm success

This module exploits an access control issue in Windows SMB clients to deploy a remote agent with SYSTEM privileges through a multi-stage attack chain: 1. DNS Injection: Adds a malicious DNS record 'localhost1UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA' via LDAP to the domain controller, pointing to the attacker's IP address. 2. NTLM Relay: Starts an ntlmrelayx server that waits for SMB authentication attempts and relays them to install an agent with SYSTEM privileges on the target system. 3. RPC Coercion: Forces the victim system to authenticate to the attacker-controlled DNS name using coercion techniques. Domain credentials from a regular user are required. The deployed agent gains SYSTEM privileges, allowing complete control of the compromised system. Affected versions: Windows 10 - 21H2 with os build less than 19044.5965 Windows 10 - 22H2 with os build less than 19045.5965 Windows 11 - 22H2 with os build less than 22621.5472 Windows 11 - 23H2 with os build less than 22631.5472 Windows 11 - 24H2 with os build less than 26100.4349 Windows Server 2019 with os build less than 17763.7434 Windows Server 2022 with os build less than 20348.3807

The Windows Cloud Files Mini Filter module (clfs.sys) present in Microsoft Windows is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition, which can result in arbitrary file write. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the exploit are: Start RasMan service Create sync root directory Create junction directory Create target junction and symlink Register sync root Create threads to exploit race condition and detect exploitation Trigger race condition Write the agent and execute it

The Agere Windows Modem module (ltmdm64.sys) present in Microsoft Windows is vulnerable to an untrusted pointer dereference, which can result in arbitrary memory write. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the exploit are: Leak the address of the current process Leak the address of the System process Leak the address of the I/O ring Trigger the vulnerability to overwrite IoRing->RegBuffersCount Trigger the vulnerability to overwrite IoRing->RegBuffers Leak the address of the System process token using I/O ring Overwrite the current process token using I/O ring Reset IoRing->RegBuffersCount to 0 Inject the agent into an elevated process

This module exploits a nested PHP array object deserialization in the MagentoFrameworkSessionSessionManager class via the $sessionConfig variable using the /rest/default/V1/guest-carts/abc/order endpoint of Magento Open Source and Adobe Commerce to deploy an agent. First, the module will upload a PHP script in the /pub/media/customer_address/s/e directory of the web application using the /customer/address_file/upload endpoint. The default webroot directory value (/var/www/html/magento/pub/) can be changed using the WEBROOT module parameter. Then, it will trigger the vulnerability using a crafted PHP array object via the /rest/default/V1/guest-carts/abc/order endpoint, that will copy the uploaded PHP script to the given webroot directory. Finally, it will deploy the agent by calling the PHP script in the webroot directory. It's important to notice that the apache user account (www-data) must have write access to the webroot directory for this exploit to work. The deployed agent will run with the apache user account (www-data) privileges.

This module exploits a nested PHP array object deserialization in the MagentoFrameworkSessionSessionManager class via the $sessionConfig variable using the /rest/default/V1/guest-carts/abc/order endpoint of Magento Open Source and Adobe Commerce to deploy an agent. First, the module will upload a PHP script in the /pub/media/customer_address/s/e directory of the web application using the /customer/address_file/upload endpoint. The default webroot directory value (/var/www/html/magento/pub/) can be changed using the WEBROOT module parameter. Then, it will trigger the vulnerability using a crafted PHP array object via the /rest/default/V1/guest-carts/abc/order endpoint, that will copy the uploaded PHP script to the given webroot directory. Finally, it will deploy the agent by calling the PHP script in the webroot directory. It's important to notice that the apache user account (www-data) must have write access to the webroot directory for this exploit to work. The deployed agent will run with the apache user account (www-data) privileges.

The Common Log File System Driver (clfs.sys) present in Microsoft Windows is vulnerable to a Use After Free, which can result in an arbitrary write. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the exploit are: Create target directory Perform a pool spray using pipes Creates two threads to win the race condition and trigger the UAF Use the RtlSetAllBits function to enable all privileges in the current process Inject a new agent into an elevated process to run as SYSTEM Successful exploitation is probabilistic and depends critically on two factors: CLFS internal state: The log container lifecycle must be coerced into the precise sequence that releases a vulnerable structure while references remain accessible. Interruptions (other CLFS activity, antivirus hooks, or system load) can alter timing and invalidate the race window. Pool spray: The density, timing, and size-class alignment of sprayed pipe allocations must closely match the freed allocation slot. Memory fragmentation, other kernel consumers, or spray volume reduce the odds of landing a controlled object in the target slot.