ResetNightmare is an authorization flaw in the Microsoft Kerberos Change Password protocol. On an unpatched domain controller, an attacker who can write the userPrincipalName attribute of a controlled account can obtain a kadmin/changepw ticket whose client name identifies another account while its PAC identifies the controlled account. The module temporarily changes the controlled account's UPN to the target sAMAccountName, requests a kadmin/changepw ticket with an NT-ENTERPRISE client name, restores the original UPN, and uses the ticket in an RFC 3244 password-change exchange. The target credentials are verified and stored as an Impact identity by default. The controlled account can be an existing user or computer whose cleartext password is known and whose userPrincipalName can be modified.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.

A Server-Side Request Forgery vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) allows unauthenticated remote attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. This module uses the previous vulnerability to upload a jsp webshell into the PSEMHUB.war directory to deploy a network agent via the /PSIGW/HttpListeningConnector endpoint. First, the module will validate the vulnerability by using a random string as operation. If the target is vulnerable, the response should be a base64 encoded java string object with the text "Invalid Operation specified" Then, the module will use the REGISTER_WITH_PEERNAME operation, to get a valid peer ObjectName Then, the module will use the HANDLE_MESSAGE operation with an embedded ExecuteProcessActivityCommand object to create the jsp webshell file inside the PSEMHUB.war directory (a web-accessible location). Finally, the module will make a request to the webshell to deploy the network agent. The deployed agent will run with the same user privileges as the target software.

A Server-Side Request Forgery vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) allows unauthenticated remote attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. This module uses the previous vulnerability to upload a jsp webshell into the PSEMHUB.war directory to deploy a network agent via the /PSIGW/HttpListeningConnector endpoint. First, the module will validate the vulnerability by using a random string as operation. If the target is vulnerable, the response should be a base64 encoded java string object with the text "Invalid Operation specified" Then, the module will use the REGISTER_WITH_PEERNAME operation, to get a valid peer ObjectName Then, the module will use the HANDLE_MESSAGE operation with an embedded ExecuteProcessActivityCommand object to create the jsp webshell file inside the PSEMHUB.war directory (a web-accessible location). Finally, the module will make a request to the webshell to deploy the network agent. The deployed agent will run with the same user privileges as the target software.

This module uses an authentication bypass vulnerability in telnetd to deploy a network agent. The module will bypass authentication by adding the "-f root" value to the USER environment variable in a telnet connection. The deployed network agent will run with root user privileges.

This module uses a relative path traversal vulnerability that leads to an authentication bypass in Fortinet FortiWeb to create a new user with administrative privileges (prof_admin) in the target system. First, the module will check if the target is vulnerable to the authentication bypass by checking the path traversal against a specific endpoint with an empty payload. If the target is vulnerable, the vulnerability will be used again to create a new user with administrative privileges (prof_admin) in the target system using the provided credentials. If no credentials are provided, the module will generate a random one. The new user credentials will be added as an identity in Impact.

This module uses a relative path traversal vulnerability that leads to an authentication bypass in Fortinet FortiWeb to create a new user with administrative privileges (prof_admin) in the target system. First, the module will check if the target is vulnerable to the authentication bypass by checking the path traversal against a specific endpoint with an empty payload. If the target is vulnerable, the vulnerability will be used again to create a new user with administrative privileges (prof_admin) in the target system using the provided credentials. If no credentials are provided, the module will generate a random one. The new user credentials will be added as an identity in Impact.

This module chains 2 vulnerabilities to deploy an agent in Progress Telerik Report Server that will run with root user privileges. The first vulnerability is an authentication bypass vulnerability present in Telerik.ReportServer.Web.Controllers.StartupController.Register class. The second vulnerability a .NET deserialization vulnerability in Telerik.Reporting.XmlSerialization.XmlSerializer class. This module will use first vulnerability to create a random user with "System Administrator" role against the "/Startup/Register" endpoint and then login into the application. Then, a report with our payload will be uploaded via the "/api/reportserver/report" endpoint. Finally, the second vulnerability will be used to deploy an agent using the "/api/reports/clients" and "/api/reports/clients/clientID/parameters" endpoints. The deployed agent will run with the privileges of the "w3wp" process (TelerikReportServer instance - NT AUTHORITY\\SYSTEM).

This module chains 2 vulnerabilities to deploy an agent in Progress Telerik Report Server that will run with root user privileges. The first vulnerability is an authentication bypass vulnerability present in Telerik.ReportServer.Web.Controllers.StartupController.Register class. The second vulnerability a .NET deserialization vulnerability in Telerik.Reporting.XmlSerialization.XmlSerializer class. This module will use first vulnerability to create a random user with "System Administrator" role against the "/Startup/Register" endpoint and then login into the application. Then, a report with our payload will be uploaded via the "/api/reportserver/report" endpoint. Finally, the second vulnerability will be used to deploy an agent using the "/api/reports/clients" and "/api/reports/clients/clientID/parameters" endpoints. The deployed agent will run with the privileges of the "w3wp" process (TelerikReportServer instance - NT AUTHORITY\\SYSTEM).