This module exploits a Deserialization vulnerability present in the OpenssoEngineController component of Oracle Access Manager.

This module exploits an authentication bypass in Veeam.Backup.ServiceLib.CForeignInvokerNegotiateAuthenticator.Authenticate. Then a file upload present in ExecuteUploadManagerPerformUpload is used to copy the Web.config file to the Webapp root foler in order to extract the machineKey values to create a ysoserial.NET payload to execute commands. The deployed agent will run with the privileges of the "IIS Worker Process" process (NT AUTHORITY\\NETWORK SERVICE).

This module exploits a JNDI injection present in the log4j library. The deployed agent will run with the root user account privileges on Linux systems and with SYSTEM privileges on Windows systems.

This module exploits a JNDI injection present in the log4j library. The deployed agent will run with the admin user account privileges.

This module exploits a JNDI injection present in the log4j library. The deployed agent will run with the root user account privileges on Linux systems and with SYSTEM privileges on Windows systems.

This module exploits a deserialization vulnerability present in the TypedBinaryFormatter class. The deployed agent will run with the SYSTEM privileges.

This module exploits a Java unsafe reflection and a Server Side Request Forgery vulnerabilities present in ProxygenController class via POST requests to the /ui/h5-vsan/rest/proxy/service endpoint. The deployed agent will run with the vsphere-ui user account privileges.

This module exploits a deserialization vulnerability present in MeetingPollHandler handler when using a ProposeOptionsMeetingPollParameters type. The deployed agent will run with the SYSTEM privileges.

This module exploits a command injection vulnerability present in the main_checkHash function of the /opt/springpath/auth/auth service. The deployed agent will run with root privileges.

This module uses a path confusion that leads to an authentication bypass (ACL) which allows unauthenticated access to an arbitrary backend URL. Then an elevation of privilege present in CommonAccessTokenFromUrl of RemotePowershellBackendCmdletProxyModule.cs is used to execute Exchange powershell commands as Exchange Administrator. Finally, an arbitrary file write present in the New-MailboxExportRequest Exchange powershell command is used to write a webshell in the system file. The deployed agent will run with the SYSTEM privileges.