This module exploits the OVSwrap nested-action length wrap on an affected Linux x86-64 kernel. It writes a generated Core Impact agent ELF to the target, creates a private user/network namespace, leaks kernel pointers through OVS actions, reads kernel memory, and applies a targeted 32-bit decrement to the local ProxyCall process credential. To bridge Generic Netlink, the module uploads and runs a statically linked Linux x86-64 transport ELF. The helper creates its own private user/network namespace; all CVE-specific exploit logic and kernel-build records remain in this module. The module writes a temporary passwordless sudo rule and runs the generated agent through sudo. It removes the rule after a root agent connects when it used a sudoers drop-in. The kernel must provide Open vSwitch, conntrack labels and FTP helper support, and allow unprivileged user/network namespaces. A matching embedded kernel-build record is preferred; otherwise local symbols, BTF or unstripped objects, and pahole are required for dynamic derivation. At least 2 GiB RAM is recommended.

This module remotely exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-88772, a memory overflow vulnerability present in the DTLS parser of the NSPPE executable of Citrix NetScaler ADC and Gateway to cause a Denial of Service. The module will exploit the vulnerability by connecting to the UDP socket of the Gateway, establish a proper DTLS state for the target to accept later handshake traffic and finally crash the NSPPE executable by sending 120 handshake records that will make the DTLS parser of the executable mishandle the reassembly/state and lead to a crash, causing a warm restart. The module will check if the denial of service was successful after 10 seconds.

This module exploits CVE-2026-88771, a command injection vulnerability present in the ns_monuploadd_err.pl script of Citrix NetScaler ADC and Gateway to deploy a Core Impact Network agent that will run with root privileges. The module will exploit the vulnerability by sending a crafted HTTP POST request the /p/u/doAuthentication.do endpoint with the payload inside the User-Agent header. The result of the HTTP request will determine if the command injection was successful. If the command injection is successful, the module will wait up to 24 hours for agent connection. This is because the appliance runs the ns_monuploadd_err.pl script every 24 hours and the attack has no way to determine the current timelapse for this behaviour. The deployed Core Impact Network agent will run with root privileges.

Windows HTTP.sys is vulnerable to an integer overflow while calculating the size required for HTTP response headers. The resulting undersized nonpaged-pool allocation can be overflowed while HTTP.sys generates the response headers, producing a heap-based buffer overflow. This module executes an exploit binary in memory. The exploit uses the memory corruption to build arbitrary kernel read and write primitives, then replaces the current agent process token with the SYSTEM process token. The steps performed by the exploit are: Prepare a local HTTP server and a crafted HTTP response Spray named-pipe data queue entries in the nonpaged pool Trigger the integer overflow and corrupt an adjacent data queue entry Build arbitrary kernel read and write primitives Locate the current agent and SYSTEM process objects Copy the SYSTEM process token to the current agent process

This module exploits CVE-2026-59310, a directory traversal vulnerability in the Syslog server component of VMware vCenter Server to deploy an Core Impact OSCI agent. The module will use the vulnerability to create a log file inside the /opt/vmware/share/htdocs/configurev2/ directory and then verify the result via a HTTP GET request to the /configurev2 endpoint via the 5480 port with a random filename terminated in the "-syslog.log" string. Then, the module will try to erase the created log file by using the vulnerability again to create a cron file inside the /etc/cron.d/ directory. The cron job will autodelete itself. If the target is vulnerable, the module will deploy an Core Impact OSCI agent with capabilities to execute commands as root. Due to the way the vulnerability is exploited, no command output is possible, so Core Impact OSCI agent terminal commands will be marked as blind.

This module performs the following steps: 1. Checks whether the Drupal i18n_sso token endpoint is present. 2. Submits a random token as a negative control and verifies that it is rejected. 3. Sends unauthenticated wildcard-token requests to the Drupal i18n_sso login endpoint. 4. Repeats the wildcard request according to MAX ATTEMPTS and POLL INTERVAL until a matching active token is found. 5. Confirms the authentication bypass only when Drupal reports success and returns a valid Drupal session cookie. 6. Uses the acquired session to identify the authenticated Drupal account. 7. Stores the session cookie as an Impact identity and records CVE-2026-16639 on the target.

A Windows Component Based Servicing elevation of privilege vulnerability allows a local attacker to make a SYSTEM TiWorker process load an unsigned sibling dpx.dll from a controlled OnePackage metadata directory. The module performs the following steps: Generates a per-run CORE Impact agent DLL named dpx.dll. Copies the target's installed, signed UpdateAgent.dll and builds a reduced DesktopDeployment cabinet with the controlled dpx.dll. Builds a small standalone OnePackage carrier on the target by using the Windows makecab utility. Executes the CBS helper directly from memory without writing the helper executable to the target filesystem. Invokes the public CBS Session COM endpoint and evaluates applicability without staging, installing, or committing the package. Causes UpdateAgent.dll to load the controlled sibling dpx.dll inside TiWorker.exe.

This module exploits CVE-2025-20281, a critical unauthenticated command injection vulnerability in the enableStrongSwanTunnel API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). Insufficient validation of user-supplied API input allows a remote attacker without valid credentials to execute arbitrary commands. The module performs the following steps: Build the deployment-rpc/enableStrongSwanTunnel endpoint from the selected target, protocol, port, and optional base path. Send an unauthenticated serialized Java String array whose first element contains a shell injection. Literal spaces are replaced with the Bash Internal Field Separator so the command survives Java Runtime.exec tokenization. Compare a baseline request with a delayed request to verify blind command execution as root inside the privileged strongswan-container. Attempt to escape the container through a writable cgroup v1 release_agent interface. The module resolves the overlay upper directory for the container root, writes a self-deleting host script, creates a child cgroup with notify_on_release enabled, and triggers the release agent. Create a marker on the persistent ISE volume and use a second time-delay probe to verify that commands execute as root on the underlying ISE host. If host execution cannot be verified, continue with root command execution inside strongswan-container and clearly report that restricted execution context. Deploy a blind OSCI agent by default. OSCI commands are relaunched through the vulnerable API and execute as root in the verified context, but stdout and stderr are not returned by the endpoint. When requested through Install OS Agent, optionally serve, download, and execute a Linux Core Impact network Agent.