This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module exploits CVE-2026-63077, a pre-authentication unsafe XML deserialization vulnerability in JetBrains TeamCity On-Premises. It registers a synthetic build agent through the agent polling protocol and submits a crafted XML document using the resulting agent session, without requiring TeamCity user credentials. Deserialization of the payload initializes an in-memory HSQLDB data source and uses HSQLDB's SCRIPT functionality to write a temporary JSP payload into the TeamCity ROOT web application. The module requests this JSP to execute an operating-system command as the account running the TeamCity server service. The JSP captures combined standard output and standard error, deletes itself when invoked, and is guarded against repeated execution. The module can verify the vulnerability, identify Linux or Windows targets, execute commands, and deploy an encrypted OSCI agent. It supports HTTP and HTTPS targets, including IPv6 addresses. Agent deployment is implemented for x86-64 Linux and Windows systems. Each command requires three HTTP requests: synthetic-agent registration, delivery of the deserialization payload, and invocation of the generated JSP. Commands are limited to 2026 characters, execution is limited to approximately 10 seconds, and captured output is limited to 1 MiB. Commands are executed with the privileges of the TeamCity server process. The exploit was tested against TeamCity 2025.11.6 on Ubuntu Linux 26.04 LTS and Windows Server 2025 Datacenter. Other vulnerable versions or platforms may also be affected but have not been verified by the engineering team.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.

This module uses a pre-authentication access-control bypass in the API of Fortinet FortiClient EMS. The module will use the vulnerability by impersonating the trusted component that normally reports a successfully verified client TLS certificate. The module will check if the target is vulnerable to the authentication bypass by sending crafted HTTP requests to the /api/v1/system/capabilities endpoint. If the target is vulnerable, the module will log and output the value returned by the /api/v1/system/version endpoint.

This module uses a chain of a REST batch route-confusion combined with a SQL injection vulnerability to deploy a network agent in WordPress Core that will run with the same user privileges than the affected software. The module will use the vulnerability chain and perform the following steps: * Check if the target is vulnerable. If it's not, the attack will stop. * Query the current number of wp_posts rows whose type is oembed_cache. This is saved so cleanup can later verify the run restored the cache count. * Create a random run_token, choose a high fake source_id, and build three unique embed URLs labeled outer, changeset, and dispatch. These are used to create traceable oEmbed cache rows for this run. * Build WordPress [embed]...[/embed] content containing those three URLs, then call union_posts(...) with a forged post row. Afterward, it will query the newest three oembed_cache row IDs and store them as outer_id, changeset_id, and dispatch_id. * Build a customize_changeset JSON payload, use the given administrator credentials (or generate random ones), and construct several fake wp_posts rows: an oEmbed cache row, a changeset row, a draft page, a request/dispatch row, a source post, and a trigger post. * Attempt to replay a privileged WordPress request using the crafted rows (via union_posts(rows, admin_body)) and create the temporary administrator account. It verifies creation either from the response or by counting matching wp_users rows. * Login as the temporary administrator, grab a REST nonce from the dashboard, create a unique plugin slug and secret web token, then call upload_and_activate(...). That helper creates a ZIP containing a temporary PHP plugin, uploads it through the WordPress plugin installer, finds the activation link, and activates it. * Send the necessary OS commands to deploy a CORE Impact agent to the temporary HTTP command endpoint via the run_command(...) function. * Call the plugin's cleanup endpoint using the secret token. The PHP plugin deletes the oEmbed/cache post IDs saved earlier. The script checks for WP2SHELL_CACHE_CLEANUP_COMPLETE. * Builds the REST API plugin path, mark the plugin inactive, then delete it through /wp-json/wp/v2/plugins/ endpoint. The REST response is checked against "deleted": true. * Identifies the current logged-in user, deletes that user with reassignment to user 1, then will check: the temporary username no longer exists, the plugin is no longer referenced in active_plugins, the final oEmbed cache count matches the baseline and the site root still returns HTTP 200.

This module uses a chain of a REST batch route-confusion combined with a SQL injection vulnerability to deploy a network agent in WordPress Core that will run with the same user privileges than the affected software. The module will use the vulnerability chain and perform the following steps: * Check if the target is vulnerable. If it's not, the attack will stop. * Query the current number of wp_posts rows whose type is oembed_cache. This is saved so cleanup can later verify the run restored the cache count. * Create a random run_token, choose a high fake source_id, and build three unique embed URLs labeled outer, changeset, and dispatch. These are used to create traceable oEmbed cache rows for this run. * Build WordPress [embed]...[/embed] content containing those three URLs, then call union_posts(...) with a forged post row. Afterward, it will query the newest three oembed_cache row IDs and store them as outer_id, changeset_id, and dispatch_id. * Build a customize_changeset JSON payload, use the given administrator credentials (or generate random ones), and construct several fake wp_posts rows: an oEmbed cache row, a changeset row, a draft page, a request/dispatch row, a source post, and a trigger post. * Attempt to replay a privileged WordPress request using the crafted rows (via union_posts(rows, admin_body)) and create the temporary administrator account. It verifies creation either from the response or by counting matching wp_users rows. * Login as the temporary administrator, grab a REST nonce from the dashboard, create a unique plugin slug and secret web token, then call upload_and_activate(...). That helper creates a ZIP containing a temporary PHP plugin, uploads it through the WordPress plugin installer, finds the activation link, and activates it. * Send the necessary OS commands to deploy a CORE Impact agent to the temporary HTTP command endpoint via the run_command(...) function. * Call the plugin's cleanup endpoint using the secret token. The PHP plugin deletes the oEmbed/cache post IDs saved earlier. The script checks for WP2SHELL_CACHE_CLEANUP_COMPLETE. * Builds the REST API plugin path, mark the plugin inactive, then delete it through /wp-json/wp/v2/plugins/ endpoint. The REST response is checked against "deleted": true. * Identifies the current logged-in user, deletes that user with reassignment to user 1, then will check: the temporary username no longer exists, the plugin is no longer referenced in active_plugins, the final oEmbed cache count matches the baseline and the site root still returns HTTP 200.

This module exploits CVE-2026-4480, an unauthenticated remote command injection vulnerability in the Samba printing subsystem. Samba passes the client-controlled print-job description to the configured "print command" through the %J substitution without escaping shell metacharacters, allowing commands to be executed remotely. The vulnerable application is a Samba print server. Affected versions are Samba 4.22.9 and earlier, 4.23.0 through 4.23.7, and 4.24.0 through 4.24.2. Exploitation requires an accessible printer share whose "print command" contains %J. This module performs the following steps: Connects to the target SMB service and binds to the spoolss named pipe using MS-RPRN. Enumerates advertised printer shares and automatically selects the first print queue, or uses the printer name supplied in Manual mode. Generates the commands required to transfer and launch a Linux x86-64 Core Impact agent. Encodes each command in Base64 and places the decoding pipeline in the client-controlled print-job description that Samba expands as %J. Submits a non-empty RAW print job and completes it to trigger the vulnerable server-side "print command". Executes the generated commands in the Samba print-processing security context and deploys the Core Impact agent.

This module exploits the Adobe ColdFusion RDS FILEIO condition exposed through /CFIDE/main/ide.cfm?ACTION=FILEIO when RDS is enabled and RDS authentication is disabled. 1. Checks that the ColdFusion HTTP service responds. 2. Reads neo-security.xml through RDS FILEIO and verifies that RDS is enabled without authentication. 3. Reads hf-updates/updates.xml and checks whether the ColdFusion update level is in the vulnerable range. 4. Writes a temporary CFML command runner to the configured webroot. 5. Retrieves the command runner over HTTP and validates Linux command execution with id. 6. Uses the resulting command primitive to commit an OSCI agent or deploy a network agent.

ProFTPD mod_sql contains an SQL escaping bypass in the SQLLog formatting pipeline. Values that start and end with a single quote and contain no internal single quotes can be treated as already escaped. When a vulnerable SQLNamedQuery wraps attacker-controlled variables such as %U in single quotes, an unauthenticated FTP USER value can break out of the logging INSERT and inject stacked SQL statements. This module targets vulnerable ProFTPD 1.3.0 through 1.3.9 deployments using mod_sql with mod_sql_postgres and a vulnerable SQLLog / SQLNamedQuery configuration. This module uses the pre-auth USER trigger commonly exposed by SQLLog ERR_* and executes operating system commands on the PostgreSQL host through COPY TO PROGRAM. Commands are base64 encoded before injection so the FTP USER payload contains no internal single quotes and satisfies the vulnerable is_escaped_text() heuristic. The exploit first resolves the target FTP service from the selected host and service metadata, configures a curl-based agent download method, and checks that the FTP banner is reachable. It then generates a short command sequence to download, chmod, and execute the agent from the PostgreSQL host. Each command is wrapped in a base64-decoding shell launcher, embedded into a stacked SQL COPY TO PROGRAM payload, and sent through an unauthenticated FTP USER command. After sending the payload sequence, the module waits for the deployed agent connection and reports the final remote code execution result. The attack requires the ProFTPD database role to be able to execute PostgreSQL COPY TO PROGRAM, and curl must be available on the PostgreSQL host for the connection types (HTTPS Channel and Connect From connection) for the agent download. The deployed agent will run with the privileges of the PostgreSQL server process.

This module exploits pedit COW, a local privilege escalation vulnerability in the Linux kernel tracked as CVE-2026-46331. The trigger binary abuses the vulnerability to execute a caller-supplied custom ELF with root privileges. The module uses this mechanism to execute a generated Core Impact agent ELF. The module uploads the pedit COW trigger binary and a generated Core Impact agent ELF with random names to the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The exploit is executed as the uploaded trigger binary with the uploaded agent path as its custom ELF argument. Once the attack is complete, a new Core Impact agent will be deployed on the target system with root user privileges. After the new agent connects, the module attempts to drop filesystem caches with the "sysctl" command and removes the uploaded trigger and agent binaries.