This module exploits an issue in GitLab CE/EE that allows sending reset emails to an unverified email address. In order to takeover the account, the module will exploit the vulnerability adding the attacker's email to the JSON from /users/password endpoint, then it will connect via IMAP to the attacker's email, parse the reset email and change the password.

This module chains together three vulnerabilities to deploy an agent. First, a vulnerability is used to obtain the exact version of Ivanti Connect Secure installed on the system. Next, the module exploits a second vulnerability that allows the attacker to access certain restricted resources without authentication, leveraging a flaw in the SAML component. Finally, the module uses a third vulnerability that enables remote code execution with elevated privileges in the management component, facilitating the injection and execution of the agent. This module uses the first vulnerability to take advantage of the lack of authentication at '/api/v1/totp/user-backup-code,' allowing unauthenticated access and route traversal. With this, the application version can be obtained by accessing '/system/system-information.' Next, it leverages an SSRF vulnerability in the xmltooling library. The '/dana-ws/saml20.ws' endpoint, which handles SOAP-based SAML requests, does not require authentication. This allows anyone to send requests to this endpoint without authentication, exploiting the SSRF vulnerability to send HTTP requests from the compromised server to internal resources. Finally, by sending a request to the SSRF-exploited endpoint, the third vulnerability is used to access the system and execute remote commands. The deployed agent will run with ROOT privileges.

The vulnerability exists due to a size miscalculation error in a integer division within the Windows DWM Core Library. A local user can trigger a heap-based buffer overflow in CCommandBuffer::Initialize method in dwmcore.dll and execute arbitrary code to install a Core Impact agent with user DWM with Integrity System privileges.This exploit checks if the target is supported and not patched. If the build is greater or equal than 22631.3593 it means the target is patched. Otherwise it proceeds to exploitation. It loads 3 files with random names in \Users\Public\Documents, the file names can be seen in the Module Log panel. It then performs two exploitation attempts by starting to copy these files into the mentioned public documents folder, after that the exploit will perform a Heap Spray on the DWM process to prepare the memory to finally trigger the Heap Overflow on DWMCORE.DLL Once the exploitation is successful the DWM process will load our DLL that executes our Core Impact agent.When the exploit finishes the files mentioned above will be deleted.

This module chains 2 vulnerabilities to deploy an agent in Magento eCommerce Web Sites that will run with the webserver user privileges. The first vulnerability is an XML External Entity Reference that leverages nested deserialization in Magento's handling of JSON data. This vulnerability allows attackers to manipulate XML input to access arbitrary files on the server. The second vulnerability is a heap buffer overflow in the iconv() function of the GNU C Library. This module will use first vulnerability to download the /proc/self/maps and the libc library. These files will allow the calculation of all the memory offsets required to exploit the second vulnerability and deploy an agent.

This module chains 2 vulnerabilities to deploy an agent in Magento eCommerce Web Sites that will run with the webserver user privileges. The first vulnerability is an XML External Entity Reference that leverages nested deserialization in Magento's handling of JSON data. This vulnerability allows attackers to manipulate XML input to access arbitrary files on the server. The second vulnerability is a heap buffer overflow in the iconv() function of the GNU C Library. This module will use first vulnerability to download the /proc/self/maps and the libc library. These files will allow the calculation of all the memory offsets required to exploit the second vulnerability and deploy an agent.

The Windows NT operating system kernel executable (ntoskrnl.exe) present in Microsoft Windows is vulnerable to a race condition, which can result in arbitrary memory write. This module allows a local unprivileged user to execute arbitrary code with SYSTEM privileges. The steps performed by the exploit are: Get the kernel address of the current process token Get the security information contained in the token using NtQueryInformationToken Calculate the value address of the first token security attribute Create a thread to win the race condition and enable privileges of the current process Deploy an agent via creating a new elevated process using winlogon.exe as parent process

This vulnerability allows local attackers to execute arbitrary code on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the n_gsm driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.

A directory traversal vulnerability in SolarWinds Serv-U FTP Server allows unauthenticated remote attackers to download system files. To take advantage of this vulnerability, we need to make a request using the InternalDir and InternalFile parameters, this will allow us to trigger a directory traversal and thus be able to read an arbitrary file. This module exploits the directory traversal to download the file specified and to save it locally in the location specified in the "OUTPUT PATH" parameter.

A vulnerability in the RecordGoodApp method allows to unauthenticated remote attackers to execute commands. This function is potentially vulnerable to an SQL injection because it uses string.Format to insert a value into the SQL query.

A SQL injection vulnerability in Fortra FileCatalyst Workflow versions 5.1.6 build 135 and earlier allows remote attackers, including anonymous ones, to exploit a SQL injection via the JOBID parameter. This could lead to unauthorized SQL commands execution such as table deletion or admin user creation. This module without authentication creates an administrative user, proceeds to authenticate with this newly created user to assess if the system is vulnerable. This module does not install an agent but instead creates an administrator user for FileCatalyst.s