module

NSClient++ 0.5.2.35 - ExternalScripts Authenticated Remote Code Execution

Try Surface Command
Back to search
Disclosed
2020-10-20
Created
2021-06-09

Description

This module allows an attacker with knowledge of the admin password of NSClient++
to start a privilege shell.
For this module to work, both web interface of NSClient++ and `ExternalScripts` feature
should be enabled.

Authors

kindredsec
Yann Castel (yann.castel Yann Castel (yann.castel@orange.com)

Platform

Windows

Architectures

x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/http/nscp_authenticated_rce
    msf exploit(nscp_authenticated_rce) > show targets
        ...targets...
    msf exploit(nscp_authenticated_rce) > set TARGET < target-id >
    msf exploit(nscp_authenticated_rce) > show options
        ...show and set options...
    msf exploit(nscp_authenticated_rce) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today