This module exploits an unauthenticated OS command injection vulnerability in rConfig using the rootUname parameter present in ajaxServerSettingsChk.php. Also, this module exploits an authenticated OS command injection vulnerability using the catCommand parameter present in search.crud.php.

This module exploits a javascript command injection vulnerability in Kibana, in the Timelion application.

This module exploits an OS command injection vulnerability in Apache Solr, via the Velocity Template.

Poor implementations of SSL servers using PKCS1 v1.5 allow an attacker to perform RSA decryption and signing operations using the private key of said servers This module tries to verify if the vulnerability is present in the target server by comparing its responses to various handcrafted messages

Apache Solr is prone to a remote vulnerability that allows attackers to take advantage of an insecure deployment of the JMX/RMI service used to manage and monitor the Java Virtual Machine. By exploiting known methods, it is possible to remotely load an MLet file from an attacker controlled web server that points at a jar file.

Adobe ColdFusion is prone to a remote vulnerability that allows attackers to take advantage of an insecure deployment of the JNBridge protocol.

The -u parameter of sudo can be used to specify a user id if preceded by '#', this module exploits a flaw in how that parameter is handled, when the id -1 is provided sudo will run the command as root even if it is restricted in the sudoers file For this exploit to work, there must be at least one directive in the sudoers file that allows a non privileged user to run a command as any user, thus by exploiting the flaw this command can be ran as root Depending on the configured commands inside the sudoers file, an new privileged agent can be deployed using only those commands. This exploit currently supports deploying the agent when vi or vim are allowed by a directive

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker).

This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.

This module runs a malicious web server on the Core Impact Console and waits for an unsuspecting user to trigger the exploit by connecting to it.