This module exploits a JNDI injection present in the log4j library. The deployed agent will run with the same privileges than the user account that ran Solr Server. This exploit will fail if the target system has jdk8u191 or newer.

This module uses an authenticated JNDI injection vulnerability via JndiBindingHandle class in Oracle Weblogic Server to upload and execute a java class file to gain arbitrary code execution on the affected system.

This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and self IP addresses, to execute arbitrary system commands, create or delete files, and disable services. This vulnerability can only be exploited through the control plane and cannot be exploited through the data plane. Exploitation can lead to complete system compromise. The BIG-IP system in Appliance mode is also vulnerable.

Apache Unomi allows conditions to use OGNL and MVEL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

This module exploits a OS Command Injection via ASP.NET markup vulnerability present in the WikiContentWebpart Web Part of Microsoft SharePoint Server to deploy an agent. The deployed agent will run with the SharePoint Server service account privileges.

This module exploits a deserialization vulnerability present in WebParts object via TypeConverters of Microsoft SharePoint Server to deploy an agent. The deployed agent will run with the SharePoint Server service account privileges.

This module exploits a deserialization vulnerability present in the DataSet object of Microsoft SharePoint Server to deploy an agent. The deployed agent will run with the SharePoint Server service account privileges.

This module exploits a server side include vulnerability present in CreateChildControls of Microsoft.SharePoint.WebPartPages.DataFormWebPart class of Microsoft SharePoint Server to deploy an agent. The deployed agent will run with the SharePoint Server service account privileges.

This module exploits an OS command injection vulnerability in Pydio Cells. The lack of sanitisation for the input of the mailer configuration could be exploited to allow an authenticated attacker to run remote code on the underlying operating system an deploy an agent.

This module exploits a directory traversal vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI). The failure in URL parsing between Apache and Java (Tomcat) allows to perform a directory traversal to access the tmshCmd.jsp page. This page allows an authenticated user to execute commands. But, using the mentioned vulnerability, an unauthenticated attacker can run remote code on the underlying operating system an deploy an agent.