This module exploits the RoguePlanet local privilege escalation vulnerability in Microsoft Defender to execute a Core Impact agent with SYSTEM privileges. The exploit abuses Defender's privileged remediation workflow. RoguePlanet first prepares an attacker-controlled Windows Error Reporting path under a writable temporary directory and forces Defender to scan it. While Defender is cleaning the detected content, the trigger uses file-system synchronization primitives to redirect operations that started in the temporary tree so they later resolve inside the native Windows directory. After the Windows Error Reporting executable is reached through that redirected path, the module triggers the Windows Error Reporting scheduled task. When the executable starts as SYSTEM, RoguePlanet uses its named-pipe handoff to duplicate the SYSTEM token into the interactive session and launch the staged Core Impact agent. Because the primitive depends on race timing, the module records trigger output, retries failed attempts, verifies the returned agent privileges, and restores the original Windows Error Reporting executable. The public RoguePlanet proof of concept reports reliable exploitation on some systems and intermittent failures on others due to race timing. The exploit has been reported as tested against Windows 10 and Windows 11 systems with June 2026 patches installed. The steps performed by the exploit are: Resolves the native Windows and temporary paths, backs up the Windows Error Reporting executable, and stages the Core Impact agent with the RoguePlanet trigger. Starts the trigger as the current non-SYSTEM user. The trigger creates the RoguePlanet named pipe, mounts its embedded ISO, and creates a controlled temporary System32\\wermgr.exe path. Calls Defender through MpClient.dll so MpScanStart detects the staged content and MpCleanStart begins privileged remediation against the controlled path. Coordinates the race by watching for the new shadow-copy device, opening the staged file's alternate data stream, using oplocks and ReadDirectoryChangesW for timing, and repeatedly swapping directories with junctions. Turns the parent temporary directory into a junction to the native Windows directory so Defender cleanup and Windows Error Reporting file operations resolve to the real Windows Error Reporting executable. Triggers the \\Microsoft\\Windows\\Windows Error Reporting\\QueueReporting scheduled task, causing Windows Error Reporting to start as SYSTEM. Completes the SYSTEM handoff over the RoguePlanet named pipe, duplicates the SYSTEM token into the pipe server's session, and launches the staged Core Impact agent with CreateProcessAsUserA. Captures trigger output, retries timing-dependent failures, verifies SYSTEM privileges, and restores the backed-up executable.

This module performs profile-driven HTTP/2 HPACK bomb denial-of-service attacks against vulnerable servers. The module selects the requested profile and applies its default attack parameters unless PORT, CONNECTIONS or STREAMS are overridden. It verifies target reachability and, when required, records a pre-attack TCP or TLS latency baseline. It then establishes HTTP/2 sessions by negotiating h2, sending the client preface, and completing the initial SETTINGS exchange. After setup, it sends profile-specific HPACK bomb payloads through HEADERS and CONTINUATION frames across multiple streams. These payloads force the server to expand small compressed header blocks into much larger in-memory header state or repeated header reconstruction work. The attacked streams are held open for a profile-specific interval, optionally using WINDOW_UPDATE drips to keep server-side state active. Finally, the module determines success from post-attack liveness, latency degradation, or recovery behavior, depending on the selected profile. Blank parameters inherit the selected profile defaults. Most profiles require TLS plus ALPN h2 support in the runtime SSL stack. Pingora can be used over cleartext h2c by disabling USE TLS.

In a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. In CUPS, the server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line "PPD:" text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary with with lp user privileges. This module will first get the list of the shared printers of the target. Then, it will register an endpoint in the local webserver for future files exfiltrations. Later, it will use the vulnerability against each shared printer to exfiltrate the /etc/os-release file. If the file is retrieved, then the target will be marked as vulnerable and the following printers will be skipped in the attack. Also, the ID field of the exfiltrated file will be used to identify the Linux distribution and decide the following step of the attack. If the Linux distribution is Arch, then the module will use the vulnerability again to deploy an agent in the target that will run with the cups user privileges. If the Linux distribution is any other, the module will use the vulnerability again to exfiltrate the /etc/passwd file. This is due the fact that in any other Linux distribution CUPS's sub-processes are isolated and monitored by AppArmor or SELinux.

CVE-2026-9082 is a SQL injection vulnerability in Drupal Core when Drupal uses PostgreSQL. The vulnerable PostgreSQL Entity Query condition handling can place attacker-controlled array keys into PDO placeholder names, allowing raw SQL to reach PostgreSQL from anonymous HTTP entry points that build entity queries. In exposed configurations, this can lead to arbitrary SQL execution, data disclosure, privilege escalation, and, when the PostgreSQL role has sufficient privileges, remote code execution. The affected Drupal Core versions are 8.9.0 through 10.4.9, 10.5.0 through 10.5.9, 10.6.0 through 10.6.8, 11.0.0 through 11.1.9, 11.2.0 through 11.2.11, and 11.3.0 through 11.3.9, only for sites using PostgreSQL. This module targets the JSON:API filter entry point. It automatically discovers a usable JSON:API resource and filter field, validates the SQL injection by leaking PostgreSQL context, and commits CVE-2026-9082 when the primitive is confirmed. If the PostgreSQL role is superuser, the module writes an Impact agent and an embedded PostgreSQL preload library through large objects, updates PostgreSQL preload settings, reloads the configuration, and launches the agent from a fresh PostgreSQL backend. If the role is not superuser, the module collects bounded PostgreSQL and Drupal evidence, then finishes gracefully after reporting that agent deployment is not possible.

This module exploits Fragnesia, a local privilege escalation vulnerability in the Linux kernel XFRM ESP-in-TCP subsystem. The vulnerability can be abused to corrupt cached pages of read-only privileged files through kernel networking components. The trigger binary temporarily corrupts the page-cache contents of "/usr/bin/su" with a small ELF launcher that executes a caller-supplied custom ELF as root. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the Fragnesia trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.

NGINX Plus and NGINX Open Source have a heap overflow vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the "rewrite" directive with a query string is followed (in the same location) by the "if" or "set" directive with an unnamed Perl-Compatible Regular Expression (PCRE) capture. An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. This module will first check if the endpoint given in the ENDPOINT parameter is present. If no parameter is provided, the module will use "/api" as the default value. Then it will send a HTTP request to the endpoint to cause the DoS and try to determine if the attack was successful.

This module verifies CVE-2026-41940, an authentication bypass vulnerability affecting cPanel and WHM. The issue can be triggered by injecting CRLF-controlled values through an HTTP Basic Authorization header, allowing a pre-authenticated WHM session file to be poisoned and later accepted as an authenticated root WHM session. The module first discovers the canonical cPanel hostname, requests a pre-authenticated WHM session cookie, sends the crafted Authorization payload with that session cookie, and extracts the resulting cpsess token from the WHM redirect. After obtaining the cpsess token, the module triggers WHM session propagation and verifies the bypass by reaching the authenticated WHM JSON API version endpoint. Successful access to that endpoint confirms that authenticated WHM API access was reached through the bypass. Once verified, the module attempts to create a cPanel account using the USERNAME, PASSWORD, and DOMAIN parameters. If those values are not provided, the module generates safe defaults for the username, password, and domain. Successfully created credentials are stored in an Impact Identity for later use. If the LIST USERS parameter is enabled, the module also queries WHM json-api/listaccts and reports the cPanel usernames returned by the target.

This module exploits an elevation of privilege vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys) to achieve arbitrary code execution with SYSTEM privileges. The vulnerability resides in the HsmOsBlockPlaceholderAccess routine and abuses the Cloud Files abort hydration path to create attacker-controlled registry keys in the .DEFAULT user hive without proper access checks. MiniPlasma is the same issue previously tracked as CVE-2020-17103, which was reported by Google Project Zero and later claimed to be patched, but it remains exploitable on current Windows builds. The steps performed by the exploit are: Creates a controlled Cloud Files synchronization root and uses the abort hydration path to trigger the race condition. Redirects privileged registry key creation into the .DEFAULT user hive. Abuses the writable .DEFAULT Volatile Environment registry key to control the windir environment used by a SYSTEM process. Triggers the elevated process to launch a CORE Impact agent with SYSTEM privileges in the target user's interactive session.

A local unprivileged user can coerce "cupsd" into authenticating to an attacker-controlled localhost IPP service with a reusable "Authorization: Local" token. That token is enough to drive "/admin/" requests on "localhost", and the attacker can combine "CUPS-Create-Local-Printer" with "printer-is-shared=true" to persist a "file:///" queue even though the normal "FileDevice" policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; allowing root command execution. This module uses the previous vulnerability to escalate privileges and deploy a new agent that will run with root user privileges. The module starts a local capture server on the port given by the CAPTURE_PORT parameter. If no parameter is provided, the module will use 9189 as the default port value. Also, the IPP port can be set with the IPP_PORT parameter. If no parameter is provided, the module will use 631 as the default port value. Then it will find and use the "ipptool" executable to trigger the local admin print to leak the auth token. The module will try to leak the token 5 times. Once the token is leaked, the module will create a temporary directory and upload the trigger and agent executables. Then it will locate the "sudo" and "whoami" executables and proceed to trigger the vulnerability to create a file inside the "/etc/sudoers.d/" directory that will allow the current user to use the "sudo" command without a password. If the attack succeeds, the agent will be executed via "sudo" which will deploy a new agent with root user privileges. Once the agent is deployed, the module will delete the trigger executable and the root file in the "/etc/sudoers.d/" directory.

This module exploits DirtyFrag, a local privilege escalation vulnerability chain in the Linux kernel that can corrupt cached pages of privileged files through kernel networking components. The trigger binary supports two exploitation paths. The ESP path temporarily corrupts the page-cache contents of "/usr/bin/su" with a small ELF launcher that executes a caller-supplied custom ELF as root. The rxrpc/rxkad path temporarily corrupts the page-cache contents of "/etc/passwd" to allow passwordless root authentication through "su" and then executes the supplied custom ELF. Before running either path, the trigger binary creates a temporary full backup of the target file it may corrupt. The ESP path restores "/usr/bin/su" from its backup after the patched "su" process is launched. The rxrpc/rxkad path restores "/etc/passwd" from its backup and removes that backup before handing execution to the custom ELF. The module uploads the DirtyFrag trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.