This module exploits a JNDI injection present in the log4j library. The deployed agent will run with the admin user account privileges.

This module exploits a JNDI injection present in the log4j library. The deployed agent will run with the root user account privileges on Linux systems and with SYSTEM privileges on Windows systems.

This module exploits a deserialization vulnerability present in the TypedBinaryFormatter class. The deployed agent will run with the SYSTEM privileges.

This module exploits a OGNL injection vulnerability present in the WebWork component of Atlassian Confluence. The deployed agent will run with tomcat privileges.

This module exploits a Java unsafe reflection and a Server Side Request Forgery vulnerabilities present in ProxygenController class via POST requests to the /ui/h5-vsan/rest/proxy/service endpoint. The deployed agent will run with the vsphere-ui user account privileges.

This module exploits a deserialization vulnerability present in MeetingPollHandler handler when using a ProposeOptionsMeetingPollParameters type. The deployed agent will run with the SYSTEM privileges.

This module exploits a command injection vulnerability present in the main_checkHash function of the /opt/springpath/auth/auth service. The deployed agent will run with root privileges.

This module uses a path confusion that leads to an authentication bypass (ACL) which allows unauthenticated access to an arbitrary backend URL. Then an elevation of privilege present in CommonAccessTokenFromUrl of RemotePowershellBackendCmdletProxyModule.cs is used to execute Exchange powershell commands as Exchange Administrator. Finally, an arbitrary file write present in the New-MailboxExportRequest Exchange powershell command is used to write a webshell in the system file. The deployed agent will run with the SYSTEM privileges.

A remote code execution vulnerability exists in OMI. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted request to a vulnerable service over a publicly accessible remote management port (ports 5986, 5985 and 1270).

This module exploits a JSON deserialization vulnerability present in the test alert actions of SolarWinds Orion Network Performance Monitor. The deployed agent will run with the privileges of the "IIS Worker Process" process (NT AUTHORITY\NETWORK SERVICE).