This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits CVE-2025-37164, an unauthenticated remote code execution vulnerability in HPE OneView. The module first queries the appliance version endpoint, then validates the vulnerability by sending a benign command to the ID Pools executeCommand REST endpoint. If the target is vulnerable, commands are executed through the same endpoint to deploy an OSCI agent or a classic network agent. The vulnerable endpoint does not return command output, so the OSCI agent is committed as a blind command execution primitive.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.

This module uses a chain of a REST batch route-confusion combined with a SQL injection vulnerability to deploy a network agent in WordPress Core that will run with the same user privileges than the affected software. The module will use the vulnerability chain and perform the following steps: * Check if the target is vulnerable. If it's not, the attack will stop. * Query the current number of wp_posts rows whose type is oembed_cache. This is saved so cleanup can later verify the run restored the cache count. * Create a random run_token, choose a high fake source_id, and build three unique embed URLs labeled outer, changeset, and dispatch. These are used to create traceable oEmbed cache rows for this run. * Build WordPress [embed]...[/embed] content containing those three URLs, then call union_posts(...) with a forged post row. Afterward, it will query the newest three oembed_cache row IDs and store them as outer_id, changeset_id, and dispatch_id. * Build a customize_changeset JSON payload, use the given administrator credentials (or generate random ones), and construct several fake wp_posts rows: an oEmbed cache row, a changeset row, a draft page, a request/dispatch row, a source post, and a trigger post. * Attempt to replay a privileged WordPress request using the crafted rows (via union_posts(rows, admin_body)) and create the temporary administrator account. It verifies creation either from the response or by counting matching wp_users rows. * Login as the temporary administrator, grab a REST nonce from the dashboard, create a unique plugin slug and secret web token, then call upload_and_activate(...). That helper creates a ZIP containing a temporary PHP plugin, uploads it through the WordPress plugin installer, finds the activation link, and activates it. * Send the necessary OS commands to deploy a CORE Impact agent to the temporary HTTP command endpoint via the run_command(...) function. * Call the plugin's cleanup endpoint using the secret token. The PHP plugin deletes the oEmbed/cache post IDs saved earlier. The script checks for WP2SHELL_CACHE_CLEANUP_COMPLETE. * Builds the REST API plugin path, mark the plugin inactive, then delete it through /wp-json/wp/v2/plugins/ endpoint. The REST response is checked against "deleted": true. * Identifies the current logged-in user, deletes that user with reassignment to user 1, then will check: the temporary username no longer exists, the plugin is no longer referenced in active_plugins, the final oEmbed cache count matches the baseline and the site root still returns HTTP 200.

This module exploits the Adobe ColdFusion RDS FILEIO condition exposed through /CFIDE/main/ide.cfm?ACTION=FILEIO when RDS is enabled and RDS authentication is disabled. 1. Checks that the ColdFusion HTTP service responds. 2. Reads neo-security.xml through RDS FILEIO and verifies that RDS is enabled without authentication. 3. Reads hf-updates/updates.xml and checks whether the ColdFusion update level is in the vulnerable range. 4. Writes a temporary CFML command runner to the configured webroot. 5. Retrieves the command runner over HTTP and validates Linux command execution with id. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

This module abuses insufficient validation in the unauthenticated JCE profiles.import endpoint to upload a crafted profile file with a PHP extension. When the file is written under the Joomla tmp directory and executed by the web server, it provides a command execution primitive. 1. Fingerprints the JCE Editor component and checks the detected version. 2. Extracts a Joomla CSRF token from the site root. 3. Uploads a PHP command runner through the vulnerable profiles.import task. 4. Verifies code execution from the Joomla tmp directory. 5. Detects the target operating system through the command runner. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

A Server-Side Request Forgery vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) allows unauthenticated remote attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. This module uses the previous vulnerability to upload a jsp webshell into the PSEMHUB.war directory to deploy a network agent via the /PSIGW/HttpListeningConnector endpoint. First, the module will validate the vulnerability by using a random string as operation. If the target is vulnerable, the response should be a base64 encoded java string object with the text "Invalid Operation specified" Then, the module will use the REGISTER_WITH_PEERNAME operation, to get a valid peer ObjectName Then, the module will use the HANDLE_MESSAGE operation with an embedded ExecuteProcessActivityCommand object to create the jsp webshell file inside the PSEMHUB.war directory (a web-accessible location). Finally, the module will make a request to the webshell to deploy the network agent. The deployed agent will run with the same user privileges as the target software.

A Server-Side Request Forgery vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) allows unauthenticated remote attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. This module uses the previous vulnerability to upload a jsp webshell into the PSEMHUB.war directory to deploy a network agent via the /PSIGW/HttpListeningConnector endpoint. First, the module will validate the vulnerability by using a random string as operation. If the target is vulnerable, the response should be a base64 encoded java string object with the text "Invalid Operation specified" Then, the module will use the REGISTER_WITH_PEERNAME operation, to get a valid peer ObjectName Then, the module will use the HANDLE_MESSAGE operation with an embedded ExecuteProcessActivityCommand object to create the jsp webshell file inside the PSEMHUB.war directory (a web-accessible location). Finally, the module will make a request to the webshell to deploy the network agent. The deployed agent will run with the same user privileges as the target software.