This module exploits CVE-2026-4480, an unauthenticated remote command injection vulnerability in the Samba printing subsystem. Samba passes the client-controlled print-job description to the configured "print command" through the %J substitution without escaping shell metacharacters, allowing commands to be executed remotely. The vulnerable application is a Samba print server. Affected versions are Samba 4.22.9 and earlier, 4.23.0 through 4.23.7, and 4.24.0 through 4.24.2. Exploitation requires an accessible printer share whose "print command" contains %J. This module performs the following steps: Connects to the target SMB service and binds to the spoolss named pipe using MS-RPRN. Enumerates advertised printer shares and automatically selects the first print queue, or uses the printer name supplied in Manual mode. Generates the commands required to transfer and launch a Linux x86-64 Core Impact agent. Encodes each command in Base64 and places the decoding pipeline in the client-controlled print-job description that Samba expands as %J. Submits a non-empty RAW print job and completes it to trigger the vulnerable server-side "print command". Executes the generated commands in the Samba print-processing security context and deploys the Core Impact agent.

This module exploits the Adobe ColdFusion RDS FILEIO condition exposed through /CFIDE/main/ide.cfm?ACTION=FILEIO when RDS is enabled and RDS authentication is disabled. 1. Checks that the ColdFusion HTTP service responds. 2. Reads neo-security.xml through RDS FILEIO and verifies that RDS is enabled without authentication. 3. Reads hf-updates/updates.xml and checks whether the ColdFusion update level is in the vulnerable range. 4. Writes a temporary CFML command runner to the configured webroot. 5. Retrieves the command runner over HTTP and validates Linux command execution with id. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

ProFTPD mod_sql contains an SQL escaping bypass in the SQLLog formatting pipeline. Values that start and end with a single quote and contain no internal single quotes can be treated as already escaped. When a vulnerable SQLNamedQuery wraps attacker-controlled variables such as %U in single quotes, an unauthenticated FTP USER value can break out of the logging INSERT and inject stacked SQL statements. This module targets vulnerable ProFTPD 1.3.0 through 1.3.9 deployments using mod_sql with mod_sql_postgres and a vulnerable SQLLog / SQLNamedQuery configuration. This module uses the pre-auth USER trigger commonly exposed by SQLLog ERR_* and executes operating system commands on the PostgreSQL host through COPY TO PROGRAM. Commands are base64 encoded before injection so the FTP USER payload contains no internal single quotes and satisfies the vulnerable is_escaped_text() heuristic. The exploit first resolves the target FTP service from the selected host and service metadata, configures a curl-based agent download method, and checks that the FTP banner is reachable. It then generates a short command sequence to download, chmod, and execute the agent from the PostgreSQL host. Each command is wrapped in a base64-decoding shell launcher, embedded into a stacked SQL COPY TO PROGRAM payload, and sent through an unauthenticated FTP USER command. After sending the payload sequence, the module waits for the deployed agent connection and reports the final remote code execution result. The attack requires the ProFTPD database role to be able to execute PostgreSQL COPY TO PROGRAM, and curl must be available on the PostgreSQL host for the connection types (HTTPS Channel and Connect From connection) for the agent download. The deployed agent will run with the privileges of the PostgreSQL server process.

This module exploits pedit COW, a local privilege escalation vulnerability in the Linux kernel tracked as CVE-2026-46331. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the pedit COW trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.

This module abuses insufficient validation in the unauthenticated JCE profiles.import endpoint to upload a crafted profile file with a PHP extension. When the file is written under the Joomla tmp directory and executed by the web server, it provides a command execution primitive. 1. Fingerprints the JCE Editor component and checks the detected version. 2. Extracts a Joomla CSRF token from the site root. 3. Uploads a PHP command runner through the vulnerable profiles.import task. 4. Verifies code execution from the Joomla tmp directory. 5. Detects the target operating system through the command runner. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

This module exploits DirtyClone, a local privilege escalation vulnerability in the Linux kernel. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the DirtyClone trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.

A Server-Side Request Forgery vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) allows unauthenticated remote attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. This module uses the previous vulnerability to upload a jsp webshell into the PSEMHUB.war directory to deploy a network agent via the /PSIGW/HttpListeningConnector endpoint. First, the module will validate the vulnerability by using a random string as operation. If the target is vulnerable, the response should be a base64 encoded java string object with the text "Invalid Operation specified" Then, the module will use the REGISTER_WITH_PEERNAME operation, to get a valid peer ObjectName Then, the module will use the HANDLE_MESSAGE operation with an embedded ExecuteProcessActivityCommand object to create the jsp webshell file inside the PSEMHUB.war directory (a web-accessible location). Finally, the module will make a request to the webshell to deploy the network agent. The deployed agent will run with the same user privileges as the target software.

A Server-Side Request Forgery vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management) allows unauthenticated remote attackers with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. This module uses the previous vulnerability to upload a jsp webshell into the PSEMHUB.war directory to deploy a network agent via the /PSIGW/HttpListeningConnector endpoint. First, the module will validate the vulnerability by using a random string as operation. If the target is vulnerable, the response should be a base64 encoded java string object with the text "Invalid Operation specified" Then, the module will use the REGISTER_WITH_PEERNAME operation, to get a valid peer ObjectName Then, the module will use the HANDLE_MESSAGE operation with an embedded ExecuteProcessActivityCommand object to create the jsp webshell file inside the PSEMHUB.war directory (a web-accessible location). Finally, the module will make a request to the webshell to deploy the network agent. The deployed agent will run with the same user privileges as the target software.

This module performs profile-driven HTTP/2 HPACK bomb denial-of-service attacks against vulnerable servers. The module selects the requested profile and applies its default attack parameters unless PORT, CONNECTIONS or STREAMS are overridden. It verifies target reachability and, when required, records a pre-attack TCP or TLS latency baseline. It then establishes HTTP/2 sessions by negotiating h2, sending the client preface, and completing the initial SETTINGS exchange. After setup, it sends profile-specific HPACK bomb payloads through HEADERS and CONTINUATION frames across multiple streams. These payloads force the server to expand small compressed header blocks into much larger in-memory header state or repeated header reconstruction work. The attacked streams are held open for a profile-specific interval, optionally using WINDOW_UPDATE drips to keep server-side state active. Finally, the module determines success from post-attack liveness, latency degradation, or recovery behavior, depending on the selected profile. Blank parameters inherit the selected profile defaults. Most profiles require TLS plus ALPN h2 support in the runtime SSL stack. Pingora can be used over cleartext h2c by disabling USE TLS.

In a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. In CUPS, the server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line "PPD:" text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary with with lp user privileges. This module will first get the list of the shared printers of the target. Then, it will register an endpoint in the local webserver for future files exfiltrations. Later, it will use the vulnerability against each shared printer to exfiltrate the /etc/os-release file. If the file is retrieved, then the target will be marked as vulnerable and the following printers will be skipped in the attack. Also, the ID field of the exfiltrated file will be used to identify the Linux distribution and decide the following step of the attack. If the Linux distribution is Arch, then the module will use the vulnerability again to deploy an agent in the target that will run with the cups user privileges. If the Linux distribution is any other, the module will use the vulnerability again to exfiltrate the /etc/passwd file. This is due the fact that in any other Linux distribution CUPS's sub-processes are isolated and monitored by AppArmor or SELinux.