Rapid7 Vulnerability & Exploit Database

ManageEngine ADAudit Plus Authenticated File Write RCE

Back to Search

ManageEngine ADAudit Plus Authenticated File Write RCE



This module exploits security issues in ManageEngine ADAudit Plus prior to 7006 that allow authenticated users to execute arbitrary code by creating a custom alert profile and leveraging its custom alert script component. The module first runs a few checks to test the provided credentials, retrieve the configured domain(s) and obtain the build number of the target ADAudit Plus server. If the credentials are valid and the target is vulnerable, the module creates an alert profile that will be triggered for any failed login attempt to the configured domain. For versions prior to build 7004, the payload is directly inserted in the custom alert script component of the alert profile. For versions 7004 and 7005, the module leverages an arbitrary file write vulnerability (CVE-2021-42847) to create a Powershell script in the alert_scripts directory that contains the payload. The name of this script is then provided as the value for the custom alert script component of the alert profile. This module requires valid credentials for an account with the privileges to create alert scripts. It has been successfully tested against ManageEngine ADAudit Plus builds 7003 and 7005 running on Windows Server 2012 R2. Successful exploitation will result in RCE as the user running ManageEngine ADAudit Plus, which will typically be the local administrator.


  • Moon
  • Erik Wynter






Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/http/manageengine_adaudit_plus_authenticated_rce
msf exploit(manageengine_adaudit_plus_authenticated_rce) > show targets
msf exploit(manageengine_adaudit_plus_authenticated_rce) > set TARGET < target-id >
msf exploit(manageengine_adaudit_plus_authenticated_rce) > show options
    ...show and set options...
msf exploit(manageengine_adaudit_plus_authenticated_rce) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security