Metasploit Framework Exploitation and Post-Exploitation

Source

---
analysis: While a single rule might detect a web shell, this hunt correlates that
  shell with URI patterns, rare registry persistence, and Kerberos relaying across
  multiple surfaces, providing the context needed to confirm a high-confidence intrusion
  rather than a benign alert.
blind_spots:
- id: no-endpoint-telemetry
  question: whether a shell was spawned on an unmanaged server
  requires: endpoint agent installation on all web servers
  risk: An unmanaged server being exploited will only show HTTP traffic, making the
    confirmation of RCE difficult.
- id: smb-over-vpn
  question: whether SMB relay occurred over a VPN tunnel
  requires: VPN traffic logs or endpoint network visibility
  risk: Outbound network connections might be masked by internal VPN traffic, hiding
    the Kerberos relay attempt.
  stage: credential-access-kerberos-relay
coverage:
- stage: initial-access-web-exploitation
  status: covered
  steps:
  - web-exploitation-patterns
  - suspicious-web-children
- stage: credential-access-kerberos-relay
  status: covered
  steps:
  - smb-auth-relay
- stage: persistence-registry-modification
  status: covered
  steps:
  - persistence-mechanisms
- reason: The linux/x64/sandbox_gate performs runtime checks that are too transient
    for process snapshots; requires live instrumentation.
  stage: evasion-sandbox-detection
  status: not_visible
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: The release of sixteen new Metasploit modules, including multiple
    zero-day exploits and persistence techniques, creates an immediate threat window
    that periodic scanning cannot close; a hunt provides behavioral verification of
    security.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder has leveraged one of sixteen new Metasploit modules to exploit
  a public-facing web application and establish persistence or conduct Kerberos authentication
  relaying.
labels:
- hunt
- attack.t1190
- attack.t1557.001
- attack.t1547.001
- attack.t1547.003
- attack.t1497.001
name: Metasploit Framework Exploitation and Post-Exploitation
parameters:
  exploit_uris:
    default:
    - /api/mcp/connect
    - action=session
    - spip.php
    - workplace
    - TeamCity/agent
    - fmc
    description: URI patterns or strings targeted by the Metasploit modules.
    type: list[string]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Target hosts to filter the hunt.
    type: list[host]
  shell_binaries:
    default:
    - cmd.exe
    - powershell.exe
    - sh
    - bash
    - zsh
    description: Shell binaries often used in RCE payloads.
    type: list[string]
  vulnerable_cves:
    default:
    - CVE-2025-66516
    - CVE-2025-54988
    - CVE-2026-19295
    - CVE-2026-20079
    - CVE-2026-63077
    - CVE-2026-23744
    - CVE-2026-82078
    - CVE-2026-48558
    - CVE-2026-75604
    - CVE-2026-83549
    description: CVEs identified in the Metasploit update.
    from:
      kind: article
      observed: '2026-09-11'
      ref: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
    type: list[string]
  web_parents:
    default:
    - httpd
    - nginx
    - w3wp.exe
    - node.exe
    - python
    - apache2
    description: Common web server process names.
    type: list[string]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Start with internet-facing assets identified in the vulnerability scan
  as exposed to the target CVEs. Focus on the Cisco FMC, SonicWall SMA, and JetBrains
  TeamCity hosts first.
references:
- name: "Rapid7 \u2014 Metasploit Wrap Up: This One Goes to Sixteen!"
  url: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
related:
- hunt: metasploit-auxiliary-scanner-detection
  reason: This hunt focuses on successful exploitation and post-exploitation; general
    Metasploit scanner activity is a broader behavioral hunt.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Exploitation of Public-Facing Applications
    observables:
    - CVE-2026-20079
    - CVE-2026-83549
    - CVE-2026-63077
    - CVE-2026-19295
    - CVE-2026-23744
    - CVE-2026-82078
    - CVE-2026-48558
    - CVE-2026-75604
    - CVE-2025-66516
    - 'URL path: /api/mcp/connect'
    - 'URL path: /action=session'
    - JSP payload delivery
    - PHP code storage in session variables
    - cmsSnmpTrap.sh command injection
    slug: initial-access-web-exploitation
    tactic: initial-access
    techniques:
    - T1190
  - name: ESC8 Kerberos Authentication Relay
    observables:
    - CVE-2026-20929
    - SMB2 AP-REQ capture
    - Relay to AD CS Web Enrollment over HTTP
    - 'Metasploit module: server/relay/esc8_kerberos'
    slug: credential-access-kerberos-relay
    tactic: credential-access
    techniques:
    - T1557.001
  - name: Registry-Based Persistence
    observables:
    - 'Registry Key: HKLM\System\CurrentControlSet\Control\BootVerificationProgram'
    - 'Registry Key: HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders'
    - Custom Time Provider DLL registration
    slug: persistence-registry-modification
    tactic: persistence
    techniques:
    - T1547.001
    - T1547.003
  - name: Sandbox Environment Detection
    observables:
    - Linux x64 runtime environment checks
    - 'Metasploit module: linux/x64/sandbox_gate'
    slug: evasion-sandbox-detection
    tactic: defense-evasion
    techniques:
    - T1497.001
  summary: The September 2026 Metasploit update introduces sixteen new modules, including
    high-impact RCE exploits for Cisco, PaperCut, and TeamCity, alongside an ESC8
    Kerberos relay capability for AD CS. The campaign encompasses initial exploitation
    via public-facing vulnerabilities, followed by advanced post-exploitation persistence
    and sandbox evasion techniques.
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
  network:
    category: network
    name: Network telemetry
    telemetry:
    - network
  web:
    category: siem
    name: Web server / proxy logs
    telemetry:
    - network
tlp: clear
type: investigation
---


# Metasploit Framework Exploitation and Post-Exploitation

This hunt targets the release of sixteen new Metasploit modules, many of which exploit high-profile CVEs in Cisco, SonicWall, TeamCity, and PaperCut. The hunt follows a phased approach: first, it identifies vulnerable hosts and triages initial access indicators like targeted HTTP URI paths and anomalous process spawning from web servers. Second, it pivots to identify follow-on post-exploitation activity, specifically searching for rare registry-based persistence via BootVerificationProgram or TimeProviders and identifying outbound SMB traffic from servers, which may indicate Kerberos relay coercion. Two agents evaluate the chain to distinguish between scanning noise and successful compromise.

## scope-vulnerable-hosts
<!-- Scope vulnerable hosts -->
Identify hosts in the estate that have been identified as vulnerable to the CVEs mentioned in the report.

```sqlite target=endpoint role=scoping params=(vulnerable_cves=vulnerable_cves)
~~~yaml
expected: A list of hosts currently exposed to the Metasploit exploits. Silence indicates
  the estate is patched.
reads:
- device_uid
- cve_uid
- severity
- affected_package_name
silence: not_evidence_of_absence
source: hb_vulnerability_finding
verified: dry-run
verified_at: '2026-09-28'
~~~
SELECT device_uid, cve_uid, severity, affected_package_name FROM hb_vulnerability_finding WHERE instr(',' || '{{vulnerable_cves}}' || ',', ',' || cve_uid || ',') > 0
```

## initial-access-triage
<!-- Triage initial access -->
parallel:
- → web-exploitation-patterns
- → suspicious-web-children
join: → initial-access-agent

## web-exploitation-patterns
<!-- Web exploitation URI patterns -->
Match HTTP requests against known targeted URIs for the new Metasploit modules.

```sqlite target=web role=triage params=(scope_hosts=scope_hosts, exploit_uris=exploit_uris, lookback_days=lookback_days)
~~~yaml
expected: Requests to specific management or vulnerable endpoints. High volume from
  external IPs indicates scanning or exploitation.
reads:
- device_hostname
- url_path
- url_query
- src_endpoint_ip
- user_agent
- time
silence: not_evidence_of_absence
source: hb_http_activity
verified: dry-run
verified_at: '2026-09-28'
~~~
SELECT device_hostname, url_path, url_query, src_endpoint_ip, user_agent, time FROM hb_http_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{exploit_uris}}' || ',', ',' || url_path || ',') > 0 OR instr(LOWER(url_query), 'action=session') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## suspicious-web-children
<!-- Suspicious web server children -->
Detect web server processes spawning shells or interpreters, indicating successful remote code execution.

```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, web_parents=web_parents, shell_binaries=shell_binaries, lookback_days=lookback_days)
~~~yaml
expected: A web server spawning a shell (e.g., cmd.exe, /bin/sh). This is the definitive
  signal of successful RCE.
reads:
- device_hostname
- process_name
- parent_process_name
- process_cmd_line
- user_name
- time
silence: not_evidence_of_absence
source: hb_process_activity
verified: dry-run
verified_at: '2026-09-28'
~~~
SELECT device_hostname, process_name, parent_process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{web_parents}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND instr(',' || '{{shell_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')
```

## initial-access-agent
<!-- Initial access agent triage -->
```agent target=hunter
cite: required
context:
- scope-vulnerable-hosts
- web-exploitation-patterns
- suspicious-web-children
max_iterations: 3
objective: Determine if any host shows evidence of successful web exploitation based
  on HTTP traffic and process anomalies.
success_criteria: A per-host verdict of compromised | suspicious | scanning, citing
  the shell command line or specific HTTP path.
tools:
- endpoint
- network
- web
```

## post-exploitation-triage
<!-- Post-exploitation triage -->
parallel:
- → persistence-mechanisms
- → smb-auth-relay
join: → final-triage-agent

## persistence-mechanisms
<!-- Registry-based persistence mechanisms -->
Find modifications to BootVerificationProgram or TimeProviders registry keys which are used by new Metasploit modules.

```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Rarely modified persistence keys pointing to non-standard binaries or DLLs.
  Baseline filters out environment-standard values.
prevalence:
  by: device_hostname
  key:
  - reg_target
  - reg_value_data
  rare_below: 3
reads:
- device_hostname
- reg_target
- reg_value_data
- time
silence: not_evidence_of_absence
source: hb_registry_activity
verified: dry-run
verified_at: '2026-09-28'
~~~
SELECT device_hostname, reg_target, reg_value_data, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_registry_activity WHERE (LOWER(reg_target) LIKE '%\bootverificationprogram%' OR LOWER(reg_target) LIKE '%\timeproviders%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY reg_target, reg_value_data HAVING host_count <= 3
```

## smb-auth-relay
<!-- SMB authentication relay attempts -->
Detect outbound SMB connections from web servers, indicating coerced authentication for credential relaying.

```sqlite target=network role=triage params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Outbound SMB (445) from a server that normally only serves HTTP. This is
  highly suspicious of credential coercion.
reads:
- device_hostname
- src_endpoint_ip
- dst_endpoint_ip
- process_name
- time
silence: not_evidence_of_absence
source: hb_network_connection
verified: dry-run
verified_at: '2026-09-28'
~~~
SELECT device_hostname, src_endpoint_ip, dst_endpoint_ip, process_name, time FROM hb_network_connection WHERE dst_endpoint_port = 445 AND direction = 'outbound' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')
```

## final-triage-agent
<!-- Final post-exploitation agent -->
```agent target=hunter
cite: required
context:
- initial-access-agent
- persistence-mechanisms
- smb-auth-relay
max_iterations: 6
objective: Combine the evidence of initial access with the persistence and relay indicators
  to confirm a full attack chain.
success_criteria: A confirmed breach verdict citing the progression from web exploit
  to persistent access or relaying.
tools:
- endpoint
- network
- web
```

## route-verdict
<!-- Route verdict -->
if~: "the final-triage-agent verdict is malicious for any host" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: no-endpoint-telemetry)
else: → close-out

## isolate-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the compromised host from the network and revoke any active credentials associated with the session.
```
→ analyst-review

## analyst-review
<!-- Analyst forensic review -->
```manual target=analyst
Review the agent's findings. Specifically, verify the registry modifications and the source of the outbound SMB connections. Determine if the shell execution on the web server was authorized maintenance or an actual breach.
```
→ end

## close-out
<!-- Close out -->
```manual target=analyst
Record the findings and update the vulnerability status for the identified hosts. If no breach was found, use the scoping results to prioritize patching the vulnerable assets.
```
→ end