Command Injection in pfSense status_rrd_graph_img.php

This repository contains a Metasploit module targeting pfSense firewalls (versions <= 2.2.6) for authenticated remote code execution (RCE) via a command injection vulnerability in the /status_rrd_graph_img.php page. The exploit requires valid (non-admin) credentials and leverages the 'graph' GET parameter to inject and execute arbitrary OS commands as root. The module automates authentication, CSRF token handling, version detection, and payload delivery. The default payload is a PHP Meterpreter reverse shell, but any PHP payload can be used. The exploit is weaponized, allowing for customizable payloads and automated cleanup. The main attack vector is network-based, targeting the pfSense web interface over HTTPS. The code is structured as a single Ruby file compatible with the Metasploit framework, and all logic is contained within the module file.

This repository contains a single Metasploit module exploit targeting pfSense firewalls (versions <= 2.3.1_1) for an authenticated remote command execution vulnerability (CVE-2016-10709). The exploit works by abusing the group member management functionality in the 'system_groupmanager.php' page, injecting arbitrary commands via the 'members[]' parameter when creating a new group. The module requires valid credentials for the pfSense web interface and interacts with the target over HTTPS (default port 443). The exploit is weaponized, supporting customizable command payloads (defaulting to a reverse shell using OpenSSL). The code is structured as a typical Metasploit module, with methods for authentication, version detection, and exploitation. The main endpoints targeted are '/index.php' for login and version checks, and '/system_groupmanager.php' for the actual exploitation. The repository is a single Ruby file, designed for use within the Metasploit framework.

This repository is a comprehensive collection of exploit and proof-of-concept (PoC) code targeting a variety of vulnerabilities across multiple platforms and products. The structure is organized into directories for HEVD (HackSysExtremeVulnerableDriver) kernel exploits (covering stack overflow, use-after-free, arbitrary write, type confusion, race condition, and stack overflow with GS), Metasploit modules (for erlang cookie RCE, pfSense graph injection, SyncBreeze buffer overflow), personal exploits (for DELL EMC OneFS, Nimsoft nimcontroller, SyncBreeze, Sysdig Monitor, VXSearch), and ported exploits (for Oracle 9i XDB, Allied Telesyn AT-TFTP, LabF nfsAxe, Jenkins, Allok AVI, MySQL UDF, and WebDAV). The main capabilities include local and remote privilege escalation, remote code execution, and information disclosure. The exploits use a variety of payloads, including custom shellcode, msfvenom-generated payloads, and ROP chains, and target both local and network attack vectors. Notable fingerprintable endpoints include device handles (e.g., \\.\HackSysExtremeVulnerableDriver), HTTP/FTP services, and specific file paths (e.g., .zshrc for persistence). The repository demonstrates advanced exploitation techniques and is suitable for research, education, and penetration testing purposes.