Skip to content

Commit e8bb3cd

Browse files
author
jenkins-metasploit
committed
automatic module_metadata_base.json update
1 parent dc97d1e commit e8bb3cd

1 file changed

Lines changed: 187 additions & 0 deletions

File tree

‎db/modules_metadata_base.json‎

Lines changed: 187 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92250,6 +92250,60 @@
9225092250
"needs_cleanup": true,
9225192251
"actions": []
9225292252
},
92253+
"exploit_linux/local/cve_2026_31431_copy_fail": {
92254+
"name": "Copy Fail AF_ALG + authencesn Page-Cache Write",
92255+
"fullname": "exploit/linux/local/cve_2026_31431_copy_fail",
92256+
"aliases": [],
92257+
"rank": 600,
92258+
"disclosure_date": "2026-04-29",
92259+
"type": "exploit",
92260+
"author": [
92261+
"Xint Code",
92262+
"rootsecdev",
92263+
"Spencer McIntyre",
92264+
"Diego Ledda"
92265+
],
92266+
"description": "CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the\n AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled\n 4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the\n on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local\n privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.\n The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and\n affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.",
92267+
"references": [
92268+
"CVE-2026-31431",
92269+
"URL-https://copy.fail/",
92270+
"URL-https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py",
92271+
"URL-https://github.com/rootsecdev/cve_2026_31431"
92272+
],
92273+
"platform": "Linux,Unix",
92274+
"arch": "cmd",
92275+
"rport": null,
92276+
"autofilter_ports": [],
92277+
"autofilter_services": [],
92278+
"targets": [
92279+
"Linux Command"
92280+
],
92281+
"mod_time": "2026-04-30 17:51:30 +0000",
92282+
"path": "/modules/exploits/linux/local/cve_2026_31431_copy_fail.rb",
92283+
"is_install_path": true,
92284+
"ref_name": "linux/local/cve_2026_31431_copy_fail",
92285+
"check": true,
92286+
"post_auth": false,
92287+
"default_credential": false,
92288+
"notes": {
92289+
"AKA": [
92290+
"Copy Fail"
92291+
],
92292+
"Stability": [
92293+
"crash-safe"
92294+
],
92295+
"Reliability": [
92296+
"repeatable-session"
92297+
],
92298+
"SideEffects": []
92299+
},
92300+
"session_types": [
92301+
"shell",
92302+
"meterpreter"
92303+
],
92304+
"needs_cleanup": null,
92305+
"actions": []
92306+
},
9225392307
"exploit_linux/local/desktop_privilege_escalation": {
9225492308
"name": "Desktop Linux Password Stealer and Privilege Escalation",
9225592309
"fullname": "exploit/linux/local/desktop_privilege_escalation",
@@ -213253,6 +213307,40 @@
213253213307
"adapted_refname": "linux/aarch64/chmod",
213254213308
"staged": false
213255213309
},
213310+
"payload_cmd/linux/http/aarch64/exec": {
213311+
"name": "HTTP Fetch, Linux Execute Command",
213312+
"fullname": "payload/cmd/linux/http/aarch64/exec",
213313+
"aliases": [],
213314+
"rank": 300,
213315+
"disclosure_date": null,
213316+
"type": "payload",
213317+
"author": [
213318+
"Brendan Watters",
213319+
"Spencer McIntyre"
213320+
],
213321+
"description": "Fetch and execute an AARCH64 payload from an HTTP server.\nExecute an arbitrary command or just a /bin/sh shell",
213322+
"references": [],
213323+
"platform": "Linux",
213324+
"arch": "cmd",
213325+
"rport": null,
213326+
"autofilter_ports": null,
213327+
"autofilter_services": null,
213328+
"targets": null,
213329+
"mod_time": "2025-01-30 13:51:05 +0000",
213330+
"path": "/modules/payloads/adapters/cmd/linux/http/aarch64.rb",
213331+
"is_install_path": true,
213332+
"ref_name": "cmd/linux/http/aarch64/exec",
213333+
"check": false,
213334+
"post_auth": false,
213335+
"default_credential": false,
213336+
"notes": {},
213337+
"session_types": false,
213338+
"needs_cleanup": false,
213339+
"payload_type": 8,
213340+
"adapter_refname": "cmd/linux/http/aarch64",
213341+
"adapted_refname": "linux/aarch64/exec",
213342+
"staged": false
213343+
},
213256213344
"payload_cmd/linux/http/aarch64/meterpreter/reverse_tcp": {
213257213345
"name": "HTTP Fetch, Reverse TCP Stager",
213258213346
"fullname": "payload/cmd/linux/http/aarch64/meterpreter/reverse_tcp",
@@ -217580,6 +217668,40 @@
217580217668
"adapted_refname": "linux/aarch64/chmod",
217581217669
"staged": false
217582217670
},
217671+
"payload_cmd/linux/https/aarch64/exec": {
217672+
"name": "HTTPS Fetch, Linux Execute Command",
217673+
"fullname": "payload/cmd/linux/https/aarch64/exec",
217674+
"aliases": [],
217675+
"rank": 300,
217676+
"disclosure_date": null,
217677+
"type": "payload",
217678+
"author": [
217679+
"Brendan Watters",
217680+
"Spencer McIntyre"
217681+
],
217682+
"description": "Fetch and execute an AARCH64 payload from an HTTPS server.\nExecute an arbitrary command or just a /bin/sh shell",
217683+
"references": [],
217684+
"platform": "Linux",
217685+
"arch": "cmd",
217686+
"rport": null,
217687+
"autofilter_ports": null,
217688+
"autofilter_services": null,
217689+
"targets": null,
217690+
"mod_time": "2025-01-30 13:51:05 +0000",
217691+
"path": "/modules/payloads/adapters/cmd/linux/https/aarch64.rb",
217692+
"is_install_path": true,
217693+
"ref_name": "cmd/linux/https/aarch64/exec",
217694+
"check": false,
217695+
"post_auth": false,
217696+
"default_credential": false,
217697+
"notes": {},
217698+
"session_types": false,
217699+
"needs_cleanup": false,
217700+
"payload_type": 8,
217701+
"adapter_refname": "cmd/linux/https/aarch64",
217702+
"adapted_refname": "linux/aarch64/exec",
217703+
"staged": false
217704+
},
217583217705
"payload_cmd/linux/https/aarch64/meterpreter/reverse_tcp": {
217584217706
"name": "HTTPS Fetch, Reverse TCP Stager",
217585217707
"fullname": "payload/cmd/linux/https/aarch64/meterpreter/reverse_tcp",
@@ -221907,6 +222029,40 @@
221907222029
"adapted_refname": "linux/aarch64/chmod",
221908222030
"staged": false
221909222031
},
222032+
"payload_cmd/linux/tftp/aarch64/exec": {
222033+
"name": "TFTP Fetch, Linux Execute Command",
222034+
"fullname": "payload/cmd/linux/tftp/aarch64/exec",
222035+
"aliases": [],
222036+
"rank": 300,
222037+
"disclosure_date": null,
222038+
"type": "payload",
222039+
"author": [
222040+
"Brendan Watters",
222041+
"Spencer McIntyre"
222042+
],
222043+
"description": "Fetch and execute an AARCH64 payload from a TFTP server.\nExecute an arbitrary command or just a /bin/sh shell",
222044+
"references": [],
222045+
"platform": "Linux",
222046+
"arch": "cmd",
222047+
"rport": null,
222048+
"autofilter_ports": null,
222049+
"autofilter_services": null,
222050+
"targets": null,
222051+
"mod_time": "2025-01-30 13:51:05 +0000",
222052+
"path": "/modules/payloads/adapters/cmd/linux/tftp/aarch64.rb",
222053+
"is_install_path": true,
222054+
"ref_name": "cmd/linux/tftp/aarch64/exec",
222055+
"check": false,
222056+
"post_auth": false,
222057+
"default_credential": false,
222058+
"notes": {},
222059+
"session_types": false,
222060+
"needs_cleanup": false,
222061+
"payload_type": 8,
222062+
"adapter_refname": "cmd/linux/tftp/aarch64",
222063+
"adapted_refname": "linux/aarch64/exec",
222064+
"staged": false
222065+
},
221910222066
"payload_cmd/linux/tftp/aarch64/meterpreter/reverse_tcp": {
221911222067
"name": "TFTP Fetch, Reverse TCP Stager",
221912222068
"fullname": "payload/cmd/linux/tftp/aarch64/meterpreter/reverse_tcp",
@@ -271561,6 +271717,37 @@
271561271717
"payload_type": 1,
271562271718
"staged": false
271563271719
},
271720+
"payload_linux/aarch64/exec": {
271721+
"name": "Linux Execute Command",
271722+
"fullname": "payload/linux/aarch64/exec",
271723+
"aliases": [],
271724+
"rank": 300,
271725+
"disclosure_date": null,
271726+
"type": "payload",
271727+
"author": [
271728+
"Spencer McIntyre"
271729+
],
271730+
"description": "Execute an arbitrary command or just a /bin/sh shell",
271731+
"references": [],
271732+
"platform": "Linux",
271733+
"arch": "aarch64",
271734+
"rport": null,
271735+
"autofilter_ports": null,
271736+
"autofilter_services": null,
271737+
"targets": null,
271738+
"mod_time": "2026-04-30 15:55:14 +0000",
271739+
"path": "/modules/payloads/singles/linux/aarch64/exec.rb",
271740+
"is_install_path": true,
271741+
"ref_name": "linux/aarch64/exec",
271742+
"check": false,
271743+
"post_auth": false,
271744+
"default_credential": false,
271745+
"notes": {},
271746+
"session_types": false,
271747+
"needs_cleanup": false,
271748+
"payload_type": 1,
271749+
"staged": false
271750+
},
271564271751
"payload_linux/aarch64/meterpreter/reverse_tcp": {
271565271752
"name": "Linux Meterpreter, Reverse TCP Stager",
271566271753
"fullname": "payload/linux/aarch64/meterpreter/reverse_tcp",

0 commit comments

Comments
 (0)