This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.
This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.
This module exploits CVE-2025-37164, an unauthenticated remote code execution vulnerability in HPE OneView. The module first queries the appliance version endpoint, then validates the vulnerability by sending a benign command to the ID Pools executeCommand REST endpoint. If the target is vulnerable, commands are executed through the same endpoint to deploy an OSCI agent or a classic network agent. The vulnerable endpoint does not return command output, so the OSCI agent is committed as a blind command execution primitive.
This module uses a chain of a REST batch route-confusion combined with a SQL injection vulnerability to deploy a network agent in WordPress Core that will run with the same user privileges than the affected software. The module will use the vulnerability chain and perform the following steps: * Check if the target is vulnerable. If it's not, the attack will stop. * Query the current number of wp_posts rows whose type is oembed_cache. This is saved so cleanup can later verify the run restored the cache count. * Create a random run_token, choose a high fake source_id, and build three unique embed URLs labeled outer, changeset, and dispatch. These are used to create traceable oEmbed cache rows for this run. * Build WordPress [embed]...[/embed] content containing those three URLs, then call union_posts(...) with a forged post row. Afterward, it will query the newest three oembed_cache row IDs and store them as outer_id, changeset_id, and dispatch_id. * Build a customize_changeset JSON payload, use the given administrator credentials (or generate random ones), and construct several fake wp_posts rows: an oEmbed cache row, a changeset row, a draft page, a request/dispatch row, a source post, and a trigger post. * Attempt to replay a privileged WordPress request using the crafted rows (via union_posts(rows, admin_body)) and create the temporary administrator account. It verifies creation either from the response or by counting matching wp_users rows. * Login as the temporary administrator, grab a REST nonce from the dashboard, create a unique plugin slug and secret web token, then call upload_and_activate(...). That helper creates a ZIP containing a temporary PHP plugin, uploads it through the WordPress plugin installer, finds the activation link, and activates it. * Send the necessary OS commands to deploy a CORE Impact agent to the temporary HTTP command endpoint via the run_command(...) function. * Call the plugin's cleanup endpoint using the secret token. The PHP plugin deletes the oEmbed/cache post IDs saved earlier. The script checks for WP2SHELL_CACHE_CLEANUP_COMPLETE. * Builds the REST API plugin path, mark the plugin inactive, then delete it through /wp-json/wp/v2/plugins/ endpoint. The REST response is checked against "deleted": true. * Identifies the current logged-in user, deletes that user with reassignment to user 1, then will check: the temporary username no longer exists, the plugin is no longer referenced in active_plugins, the final oEmbed cache count matches the baseline and the site root still returns HTTP 200.
This module exploits the Adobe ColdFusion RDS FILEIO condition exposed through /CFIDE/main/ide.cfm?ACTION=FILEIO when RDS is enabled and RDS authentication is disabled. 1. Checks that the ColdFusion HTTP service responds. 2. Reads neo-security.xml through RDS FILEIO and verifies that RDS is enabled without authentication. 3. Reads hf-updates/updates.xml and checks whether the ColdFusion update level is in the vulnerable range. 4. Writes a temporary CFML command runner to the configured webroot. 5. Retrieves the command runner over HTTP and validates Linux command execution with id. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.
This module abuses insufficient validation in the unauthenticated JCE profiles.import endpoint to upload a crafted profile file with a PHP extension. When the file is written under the Joomla tmp directory and executed by the web server, it provides a command execution primitive. 1. Fingerprints the JCE Editor component and checks the detected version. 2. Extracts a Joomla CSRF token from the site root. 3. Uploads a PHP command runner through the vulnerable profiles.import task. 4. Verifies code execution from the Joomla tmp directory. 5. Detects the target operating system through the command runner. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.
This module uses an authenticated OS command injection vulnerability in Fortinet FortiWeb to deploy a python agent. First, the module will login in the target application using the given credentials. If no credentials are supplied, the module will attempt to create a new user with administrative privileges (prof_admin) in the target system using random credentials via CVE-2025-64446 vulnerability. If authentication succeeds, the module will save the new user credentials as an identity in Impact. Next, the module will retrieve the target system version via the /api/v2.0/system/state endpoint. The version will be used to select the attack payload. Then, the module will switch to websockets usage via the /ws/cli/open endpoint to access the CLI. Finally, it will send CLI commands to create a new SAML configuration with the OS commands to deploy a python agent. The deployed python agent will run with root user privileges.
This module uses an insecure deserialization vulnerability in React Server Components to deploy an agent. The module will first check if the target is vulnerable by using the given endpoint with a generic payload. If the target is vulnerable, an OSCI agent will be deployed and the vulnerability will be used again, with a payload that will deploy an in-memory webshell. This webshell can be used later by the OSCI agent to execute OS commands or deploy a network agent. The deployed agent will run with the same privileges of the webapp.
This module exploits an OS Command Injection present in the getCASURL perl function of Dell Unity to deploy an agent. The module will trigger the vulnerability by embedding the system commands to deploy the agent in a request to the /misc endpoint. Spaces in the system command will be replaced with the ${IFS} shell variable. The deployed agent will run with the apache user account privileges.
Subscribe to OS Command Injection