Metasploit Wrap-Up 12/19/2025

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.rapid7.com/blog/post/metasploit-wrap-up-12-19-2025
• Blog Title: Metasploit Wrap-Up 12/19/2025
• Suggested Section: Pentesting Web -> XXE - XEE - XML External Entity (for the auth-bypass+XXE arbitrary file read chain) and Pentesting Web -> SSTI (Server Side Template Injection) (for the Twig sandbox bypass RCE pattern); optionally cross-referenced from Web Vulnerabilities Methodology.

🎯 Content Summary

This Metasploit weekly wrap-up describes concrete exploitation capabilities and framework behavior changes, focusing on improvements to the React2Shell exploit payloads, a new N-able N-Central auth-bypass+XXE scanner, and a Grav CMS Twig SSTI sandbox-bypass RCE module. It also documents core framework enhancements to how vulnerabilities/services are reported and how default payloads are selected.

React2Shell payload improvements and framework-wide payload selection

Metas...

🔧 Technical Details

Chaining unauthenticated session bypass with XXE for arbitrary file read
The N-able N-Central technique chains an authentication bypass with XXE to provide unauthenticated arbitrary file disclosure. First, exploit a logic flaw (CVE-2025-9316) to obtain a server-accepted session without credentials (e.g., causing the app to issue valid cookies or accept unauthenticated requests as authenticated). Then, with that session, target an XML-parsing endpoint vulnerable to XXE (CVE-2025-11700). Send XML declaring an external entity that points to a local file such as file:///etc/passwd:

<!DOCTYPE xxe [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<root>&xxe;</root>

When the parser resolves &xxe;, the file’s contents are injected into the response, giving the attacker remote, unauthenticated file read. This pattern can be generalized: use any pre-auth or weak-auth logic bug to reach otherwise restri...

🤖 Agent Actions

Summary:

• Added a new “Chaining unauthenticated session bypass with SOAP XXE” section to xxe-xee-xml-external-entity.md, detailing how CVE-2025-9316 + CVE-2025-11700 are combined in N-able N-Central, complete with SOAP request snippets, the malicious DTD pattern, operational guidance, and new references to the Rapid7 wrap-up and the released Metasploit module.
• Documented the Grav CMS Twig sandbox bypass workflow in ssti-server-side-template-injection/README.md, showing how attackers edit the form process block, submit Twig payloads that register undefined-function callbacks, and land cross-platform shells; added the corresponding references for the blog and Metasploit exploit.
• Updated web-vulnerabilities-methodology.md with a note reminding testers to chain pre-auth workflow flaws with XXE/SSTI surfaces and appended a references section citing the Rapid7 blog so the checklist now points back to the new guidance.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 935
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.rapid7.com/blog/post/metasploit-wrap-up-12-19-2025

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> XXE - XEE - XML External Entity (for the auth-bypass+XXE arbitrary file read chain) and Pentesting Web -> SSTI (Server Side Template Injection) (for the Twig sandbox bypass RCE pattern); optionally cross-referenced from Web Vulnerabilities Methodology.".

Repository Maintenance:

• MD Files Formatting: 935 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0