Microsoft Install Service grants an interactive standard user write access to plugin configuration beneath HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\InstallService\\State. The service consumes this configuration while running as SYSTEM. The module writes an agent DLL to a publicly readable directory, registers a fresh plugin name in PlugInList and StaticPluginMap, and invokes AppInstallManager.SearchForAllUpdatesAsync(). Install Service then loads the agent DLL as SYSTEM.

This module exploits CVE-2026-4480, an unauthenticated remote command injection vulnerability in the Samba printing subsystem. Samba passes the client-controlled print-job description to the configured "print command" through the %J substitution without escaping shell metacharacters, allowing commands to be executed remotely. The vulnerable application is a Samba print server. Affected versions are Samba 4.22.9 and earlier, 4.23.0 through 4.23.7, and 4.24.0 through 4.24.2. Exploitation requires an accessible printer share whose "print command" contains %J. This module performs the following steps: Connects to the target SMB service and binds to the spoolss named pipe using MS-RPRN. Enumerates advertised printer shares and automatically selects the first print queue, or uses the printer name supplied in Manual mode. Generates the commands required to transfer and launch a Linux x86-64 Core Impact agent. Encodes each command in Base64 and places the decoding pipeline in the client-controlled print-job description that Samba expands as %J. Submits a non-empty RAW print job and completes it to trigger the vulnerable server-side "print command". Executes the generated commands in the Samba print-processing security context and deploys the Core Impact agent.

This module exploits the Adobe ColdFusion RDS FILEIO condition exposed through /CFIDE/main/ide.cfm?ACTION=FILEIO when RDS is enabled and RDS authentication is disabled. 1. Checks that the ColdFusion HTTP service responds. 2. Reads neo-security.xml through RDS FILEIO and verifies that RDS is enabled without authentication. 3. Reads hf-updates/updates.xml and checks whether the ColdFusion update level is in the vulnerable range. 4. Writes a temporary CFML command runner to the configured webroot. 5. Retrieves the command runner over HTTP and validates Linux command execution with id. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

This module uses a .NET deserialization vulnerability to deploy a network agent in Veeam Backup and Replication MountService that will run with the NT AUTHORITY\SYSTEM user privileges. First, the module will register an endpoint in the local webserver that will be used in the attack to send a serialized gadget to the target that will execute system commands to deploy the agent. Finally, it will trigger the vulnerability by crafting a System.Runtime.Remoting.ObjRef .NET class type object and sending it to the /PermanentSessionService .NET remoting endpoint using an external .NET executable. The deserialization of the crafted object will force a POST HTTP request to the registered endpoint in the local webserver, which will, in turn, deliver the serialized gadget that will deploy the agent.

ProFTPD mod_sql contains an SQL escaping bypass in the SQLLog formatting pipeline. Values that start and end with a single quote and contain no internal single quotes can be treated as already escaped. When a vulnerable SQLNamedQuery wraps attacker-controlled variables such as %U in single quotes, an unauthenticated FTP USER value can break out of the logging INSERT and inject stacked SQL statements. This module targets vulnerable ProFTPD 1.3.0 through 1.3.9 deployments using mod_sql with mod_sql_postgres and a vulnerable SQLLog / SQLNamedQuery configuration. This module uses the pre-auth USER trigger commonly exposed by SQLLog ERR_* and executes operating system commands on the PostgreSQL host through COPY TO PROGRAM. Commands are base64 encoded before injection so the FTP USER payload contains no internal single quotes and satisfies the vulnerable is_escaped_text() heuristic. The exploit first resolves the target FTP service from the selected host and service metadata, configures a curl-based agent download method, and checks that the FTP banner is reachable. It then generates a short command sequence to download, chmod, and execute the agent from the PostgreSQL host. Each command is wrapped in a base64-decoding shell launcher, embedded into a stacked SQL COPY TO PROGRAM payload, and sent through an unauthenticated FTP USER command. After sending the payload sequence, the module waits for the deployed agent connection and reports the final remote code execution result. The attack requires the ProFTPD database role to be able to execute PostgreSQL COPY TO PROGRAM, and curl must be available on the PostgreSQL host for the connection types (HTTPS Channel and Connect From connection) for the agent download. The deployed agent will run with the privileges of the PostgreSQL server process.

The Microsoft Windows NT OS Kernel is affected by an elevation of privilege vulnerability. This module executes a BOF payload that attempts to elevate the current agent process to SYSTEM privileges. The steps performed by the exploit to elevate privileges are: Prepare WMI QuerySingleMultiple buffers and spray NPFS pipe objects in kernel pool Open a WMIDataDevice handle and resolve a WMI instance suitable for the vulnerable query path Trigger the vulnerable WMI query to corrupt an adjacent pipe object Use the corrupted pipe to leak kernel pool metadata and build an arbitrary read primitive Locate the current process and SYSTEM process objects, then read the SYSTEM token Self-elevate the current agent by writing the SYSTEM token into its own process token field

This module exploits pedit COW, a local privilege escalation vulnerability in the Linux kernel tracked as CVE-2026-46331. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the pedit COW trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.

This module abuses insufficient validation in the unauthenticated JCE profiles.import endpoint to upload a crafted profile file with a PHP extension. When the file is written under the Joomla tmp directory and executed by the web server, it provides a command execution primitive. 1. Fingerprints the JCE Editor component and checks the detected version. 2. Extracts a Joomla CSRF token from the site root. 3. Uploads a PHP command runner through the vulnerable profiles.import task. 4. Verifies code execution from the Joomla tmp directory. 5. Detects the target operating system through the command runner. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

This module checks for and exploits CVE-2026-44825, a hardcoded credentials exposure in the Apache Solr AuthTool BasicAuth configuration workflow. The vulnerability occurs when an Apache SolrCloud deployment is initialized with bin/solr auth enable. During that process, AuthTool loads the bundled security.json template and adds the administrator-supplied user, but it may leave template users such as superadmin, admin, index, and search enabled. In affected installations, those users keep trivial passwords equal to their usernames. In affected installations, those users keep trivial passwords equal to their usernames (superadmin, admin, index, search). As a result, a remote attacker who can reach the Solr HTTP interface may authenticate with predictable credentials and access protected administrative endpoints. If the template accounts have high-impact permissions, the attacker may also be able to modify authentication or authorization settings, create users, or assign roles. Steps: Fingerprint the target by querying Apache Solr administrative endpoints and checking for Solr, BasicAuth, SolrCloud, and version indicators. Attempt the known template credentials superadmin:superadmin, admin:admin, index:index, and search:search against read-only administrative endpoints. If any template credential is accepted, mark the target as vulnerable and register CVE-2026-44825. Retrieve authorization data with the accepted credential and report the effective roles and permissions, including high-impact permissions such as security-edit, config-edit, core-admin-edit, and collection-admin-edit. A malicious attacker with this account may access indexed data stored in Solr and, depending on the assigned roles, create or modify Solr users and roles, change security settings, or alter core and collection configuration. If CREATE USER parameters are provided, use the valid template credential to create or update a proof user through /admin/authentication. Assign the proof user the template roles through /admin/authorization to demonstrate security configuration impact. Verify that the proof user can authenticate successfully and store the created credentials in Identity as exploitation evidence.

This module exploits DirtyClone, a local privilege escalation vulnerability in the Linux kernel. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the DirtyClone trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.