This module exploits a command injection vulnerability present in the main_checkHash function of the /opt/springpath/auth/auth service. The deployed agent will run with root privileges.

This module exploits a path traversal vulnerability in Apache Server which allows an attacker to download system files through specially crafted HTTP resource requests. This vulnerability is a bypass of CVE-2021-41773.

This module uses a path confusion that leads to an authentication bypass (ACL) which allows unauthenticated access to an arbitrary backend URL. Then an elevation of privilege present in CommonAccessTokenFromUrl of RemotePowershellBackendCmdletProxyModule.cs is used to execute Exchange powershell commands as Exchange Administrator. Finally, an arbitrary file write present in the New-MailboxExportRequest Exchange powershell command is used to write a webshell in the system file. The deployed agent will run with the SYSTEM privileges.

An elevation of privilege vulnerability exists in the way the win32kbase component handles objects in memory.

A remote code execution vulnerability exists in OMI. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted request to a vulnerable service over a publicly accessible remote management port (ports 5986, 5985 and 1270).

This module exploits a path traversal vulnerability in Apache Server which allows an attacker to download system files through specially crafted HTTP resource requests.

The Windows kernel is prone to a race condition bug when creating/deleting symbolic links, since it does not properly acquire/release kernel locks.

This module uses a reverse proxy bypass vulnerability to access restricted endpoints as declared in the analytics-proxy.conf file. Also, it uses an unauthenticated file upload vulnerability present in the DataAppAgentController class, when using the action=collect parameter. The deployed agent will run with root privileges.

This module exploits a vulnerability in Microsoft MSHTML, which can be leveraged to execute arbitrary code on vulnerable machines by convincing an unsuspecting user to visit a malicious web site.

The MODAPI.sys driver in MSI Dragon Center 2.0.104.0 exposes functionality that allows low-privileged users to write an arbitrary value to a Model-Specific Register (MSR) at the specified address via specially crafted IOCTL requests.