module

Lucee Authenticated Scheduled Job Code Execution

Try Surface Command
Back to search
Disclosed
Feb 10, 2023
Created
Mar 2, 2023

Description

This module can be used to execute a payload on Lucee servers that have an exposed
administrative web interface. It's possible for an administrator to create a
scheduled job that queries a remote ColdFusion file, which is then downloaded and executed
when accessed. The payload is uploaded as a cfm file when queried by the target server. When executed,
the payload will run as the user specified during the Lucee installation. On Windows, this is a service account;
on Linux, it is either the root user or lucee.

Author

Alexander Philiotis

Platform

Unix,Windows

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/http/lucee_scheduled_job
    msf exploit(lucee_scheduled_job) > show targets
        ...targets...
    msf exploit(lucee_scheduled_job) > set TARGET < target-id >
    msf exploit(lucee_scheduled_job) > show options
        ...show and set options...
    msf exploit(lucee_scheduled_job) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report