This module exploits a OGNL injection vulnerability present in the WebWork component of Atlassian Confluence. The deployed agent will run with tomcat privileges.

An attacker who successfully exploited the vulnerability could execute code with elevated permissions.

This module exploits a Java unsafe reflection and a Server Side Request Forgery vulnerabilities present in ProxygenController class via POST requests to the /ui/h5-vsan/rest/proxy/service endpoint. The deployed agent will run with the vsphere-ui user account privileges.

This module exploits a deserialization vulnerability present in MeetingPollHandler handler when using a ProposeOptionsMeetingPollParameters type. The deployed agent will run with the SYSTEM privileges.

This module exploits a command injection vulnerability present in the main_checkHash function of the /opt/springpath/auth/auth service. The deployed agent will run with root privileges.

This module exploits a path traversal vulnerability in Apache Server which allows an attacker to download system files through specially crafted HTTP resource requests. This vulnerability is a bypass of CVE-2021-41773.

This module uses a path confusion that leads to an authentication bypass (ACL) which allows unauthenticated access to an arbitrary backend URL. Then an elevation of privilege present in CommonAccessTokenFromUrl of RemotePowershellBackendCmdletProxyModule.cs is used to execute Exchange powershell commands as Exchange Administrator. Finally, an arbitrary file write present in the New-MailboxExportRequest Exchange powershell command is used to write a webshell in the system file. The deployed agent will run with the SYSTEM privileges.

An elevation of privilege vulnerability exists in the way the win32kbase component handles objects in memory.

A remote code execution vulnerability exists in OMI. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted request to a vulnerable service over a publicly accessible remote management port (ports 5986, 5985 and 1270).

This module exploits a path traversal vulnerability in Apache Server which allows an attacker to download system files through specially crafted HTTP resource requests.