This module abuses Jolokia access to invoke the ActiveMQ Broker MBean addNetworkConnector operation. The crafted connector uses the VM transport brokerConfig option to load a Spring XML document from the IMPACT web server. The XML instantiates java.lang.ProcessBuilder and executes the agent deployment command sequence. The exploitation process performs the following steps: Starts the IMPACT web server and registers a randomized Spring XML payload path. Checks that the target Jolokia endpoint is reachable with the configured credentials. Discovers the ActiveMQ broker name through Jolokia, or uses the configured broker name when provided. Builds a malicious network connector URI using vm:// and brokerConfig=xbean to reference the Spring XML payload hosted by IMPACT. Sends a Jolokia exec request to call addNetworkConnector(java.lang.String) on the ActiveMQ Broker MBean. Waits for the target to fetch the Spring XML payload and execute the generated agent deployment command sequence. The deployed agent will run with the same privileges as the Apache ActiveMQ service.

This module exploits CVE-2026-33017 by abusing Langflow's public temporary flow build endpoint to inject and execute a custom component. The component runs operating system commands through the Langflow Python process. If AUTO_LOGIN is enabled on the target, the module can automatically create a public flow. Otherwise, provide a known public FLOW ID. If no FLOW ID is provided, the module can use AUTO_LOGIN to obtain an access token and create a public Langflow flow. The module then submits a crafted temporary custom component to the /api/v1/build_public_tmp/{flow_id}/flow endpoint. That component executes operating system commands through the Langflow Python process and returns command output through Langflow build events. When DEPLOY OSCI AGENT is enabled, the module commits an OSCI agent that reuses the same Langflow primitive to relaunch commands later. When DEPLOY NETWORK AGENT is enabled, the module stages an Impact payload from the embedded web server and launches it through the vulnerable Langflow service. The module polls Langflow job events to track execution and confirm whether command execution or agent deployment succeeded. The deployed agent will run with the privileges of the Langflow service account.

This module uses an incorrect 'in-place operation' vulnerability in the Linux kernel's algif_aead cryptographic algorithm interface by abusing the authencesn AEAD wrapper to deploy a network agent. The vulnerability will overwrite kernel's cached pages of a given SUID file. The module will upload a trigger binary for the vulnerability in the temporary directory given in the TMP_DIR parameter. If no parameter is provided, the module will use "/tmp" as the default value. The binary SUID file given in the TARGET_SUID_BINARY parameter will be used for the attack. If no parameter is provided, the module will use "/usr/bin/su" as the default value. Once the attack is complete a new Core Impact agent will be deployed in the target system that will run with root user privileges. Finally, the module will use the "sysctl" command to restore the cache.

This module authenticates to the Zabbix JSON-RPC API with the supplied account, discovers the remote API version, and attempts SQLi-based administrator session extraction through CUser::addRelatedObjects(), reachable from the user.get method. CVE-2024-42327 does not require an administrator account. A non-admin user with the default User role, or any role with API access, can reach the vulnerable user.get API path. The affected Zabbix application versions are 6.0.x before 6.0.32rc1, 6.4.x before 6.4.17rc1, and 7.0.x before 7.0.1rc1. When SQLi session extraction succeeds, the module uses the extracted session to check whether Zabbix system.run is enabled and installs a Core Impact agent only if system.run is enabled. The module performs the following steps: 1. Discovers a reachable Zabbix JSON-RPC API endpoint and reads the remote version. 2. Authenticates with the supplied Zabbix credentials. 3. Checks whether the detected version is within the publicly affected CVE-2024-42327 ranges. 4. Attempts to extract an administrator session through SQLi-based timing checks. 5. Commits CVE-2024-42327 when administrator session extraction succeeds. 6. Uses the extracted session to resolve the target host and interface context. 7. Checks whether Zabbix system.run is enabled on the target Zabbix agent. 8. installs a Core Impact agent through system.run only when that capability is available. 9. Removes temporary Zabbix items created during probing or deployment.

A vulnerability chain in Vim enables arbitrary OS command execution via a specially crafted file. The tabpanel option lacks the P_MLE flag, which allows a modeline to inject a %{expr} string even when modelineexpr is disabled. While the expression is initially evaluated within a sandbox, the autocmd_add() function fails to call check_secure(). This oversight allows sandboxed code to register an autocommand that triggers after the sandbox environment has been exited, resulting in a full sandbox escape.

This module chains two vulnerabilities in n8n to achieve unauthenticated remote code execution. The module abuses a vulnerable unauthenticated form endpoint to read local files from the target system. That file read primitive is then used to recover the n8n home path, configuration data, and encryption key material. The module then reads the n8n SQLite database to extract administrator account data from the application datastore. With that information, it forges an authenticated administrator token and creates a malicious workflow through the n8n API. Finally, the crafted workflow is used to execute operating system commands and deploy an agent on the target. The deployed agent will run with the privileges of the n8n service account.

This module uses an authentication bypass vulnerability in telnetd to deploy a network agent. The module will bypass authentication by adding the "-f root" value to the USER environment variable in a telnet connection. The deployed network agent will run with root user privileges.

This module uses an authenticated OS command injection vulnerability in Fortinet FortiWeb to deploy a python agent. First, the module will login in the target application using the given credentials. If no credentials are supplied, the module will attempt to create a new user with administrative privileges (prof_admin) in the target system using random credentials via CVE-2025-64446 vulnerability. If authentication succeeds, the module will save the new user credentials as an identity in Impact. Next, the module will retrieve the target system version via the /api/v2.0/system/state endpoint. The version will be used to select the attack payload. Then, the module will switch to websockets usage via the /ws/cli/open endpoint to access the CLI. Finally, it will send CLI commands to create a new SAML configuration with the OS commands to deploy a python agent. The deployed python agent will run with root user privileges.

MongoDB Server is vulnerable to a memory disclosure flaw due to improper validation of length parameters in Zlib-compressed protocol headers. This vulnerability allows unauthenticated remote attackers to read sensitive information from server memory. This module will check if the target machine is vulnerable and it will try to dump memory contents to the Module Log window and also writes them in a file. This memory dump may contain sensitive data, as explained above. This module performs the following steps: Establishes TCP connection to the target MongoDB server on port 27017. Sends crafted malicious packets containing BSON documents with intentionally inflated length values, Zlib-compressed OP_MSG messages wrapped in OP_COMPRESSED headers and a crafted Buffer size. Iterates through document lengths. Extracts and collects leaked memory from server error responses. Show collected memory leaks in the module output, and save it to disk (if output folder specified) for further analysis.

This module uses a relative path traversal vulnerability that leads to an authentication bypass in Fortinet FortiWeb to create a new user with administrative privileges (prof_admin) in the target system. First, the module will check if the target is vulnerable to the authentication bypass by checking the path traversal against a specific endpoint with an empty payload. If the target is vulnerable, the vulnerability will be used again to create a new user with administrative privileges (prof_admin) in the target system using the provided credentials. If no credentials are provided, the module will generate a random one. The new user credentials will be added as an identity in Impact.