--- analysis: A single rule might flag the exploit name, but this hunt combines vulnerability state, stack-counted module prevalence, and process behavioral analysis (like on_disk = 0) to provide a complete picture of the post-exploitation phase. blind_spots: - id: no-file-telemetry question: Was a malicious PAM module uploaded but not yet loaded into a process? requires: hb_file_activity with deep scan risk: A module on disk that hasn't been loaded yet will be missed by the prevalence check on hb_module_activity. stage: persistence-via-auth-and-config - id: no-script-content question: Is the enumeration module running entirely in memory without spawning new processes? requires: hb_script_activity with full block capture risk: If the Metasploit module discovery logic is executed via an existing interpreter without unique command line arguments, hb_process_activity might miss it. stage: security-software-discovery coverage: - stage: linux-local-privilege-escalation status: covered steps: - exploit-behavior - stage: persistence-via-auth-and-config status: covered steps: - rare-pam-modules - exploit-behavior - stage: security-software-discovery status: covered steps: - exploit-behavior - reason: 'Belongs to another part of the ''Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules'' series.' stage: unauthenticated-rce-web-services status: out_of_scope - reason: 'Belongs to another part of the ''Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules'' series.' stage: windows-aarch64-payload-fetch status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The release of new Metasploit modules lowers the bar for exploiting these specific vulnerabilities. Proactively hunting for these behaviors ensures detection of intrusions that bypass static signatures. methodology: model-assisted trigger: intel-report hypothesis: An adversary escalates Linux privileges via snap-confine or DirtyClone and establishes persistence through PAM backdoors or Ollama auto-update tampering. labels: - hunt - attack.t1068 - attack.t1556 - attack.t1574.002 - attack.t1518.001 - discovery - execution - initial access - persistence - privilege escalation name: Local Escalation and Persistence via Metasploit Modules parameters: lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hostnames to focus the hunt; leave empty for all hosts. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-a-collection-of-what-can-only-be-called-eclectic-modules gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Focus on Linux servers running snapd and Windows machines running Ollama. Use the vulnerability scoping step to identify high-priority targets first. references: - name: "Rapid7 \u2014 Metasploit Wrap Up: A Collection of What Can Only Be Called\ \ Eclectic Modules" url: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-a-collection-of-what-can-only-be-called-eclectic-modules related: - hunt: unauthenticated-rce-web-services reason: This hunt focuses on post-exploitation local activity; initial access via web service exploits is covered in a sibling hunt. relation: out-of-scope-alternative - hunt: metasploit-rce-aarch64-payload-delivery relation: follows scenario: stages: - name: Unauthenticated RCE in Web and LLM Services observables: - POST requests to /validate endpoint with exec_globals parameter (Langflow) - Modification of FFMPEG Executable Path settings in dizqueTV - Requests to MCP test REST endpoints in LiteLLM proxy - Struts BeanUtils exploitation against N-able N-central slug: unauthenticated-rce-web-services tactic: initial-access techniques: - T1190 - name: Windows AArch64 Payload Fetching observables: - Execution of cmd/windows/http/aarch64/exec - Execution of cmd/windows/tftp/aarch64/shell_reverse_tcp - Command-line file transfers via FTP, HTTP, HTTPS, or TFTP on AArch64 Windows systems slug: windows-aarch64-payload-fetch tactic: execution techniques: - T1105 - T1059 - name: Linux Local Privilege Escalation observables: - Exploitation of snap-confine TOCTOU race condition (CVE-2026-3888) - DirtyClone exploit execution (CVE-2026-43503) - Execution as root inside OpenCTI API containers via safeEjs sandbox escape slug: linux-local-privilege-escalation tactic: privilege-escalation techniques: - T1068 - name: Persistence via PAM and Config Tampering observables: - Upload of malicious .so files into the Linux PAM authentication chain - Path traversal exploitation in Ollama auto-update mechanism (CVE-2026-42249) slug: persistence-via-auth-and-config tactic: persistence techniques: - T1556 - T1574.002 - name: Security Software Discovery observables: - Execution of post/linux/gather/enum_protections - Automated enumeration of AV/EDR protections on the target system slug: security-software-discovery tactic: discovery techniques: - T1518.001 summary: This campaign involves the exploitation of unauthenticated remote code execution vulnerabilities in LLM-related services and IPTV servers, followed by the delivery of fetch-based payloads to Windows AArch64 systems. Attackers then perform local privilege escalation on Linux systems and establish persistence through configuration tampering or malicious authentication modules. series: index: 2 slug: metasploit-wrap-up-a-collection-of-what-can-only-be-called-eclectic-modules title: 'Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # Local Escalation and Persistence via Metasploit Modules The adversary uses Metasploit modules to move from a beachhead to full control. This hunt identifies vulnerable systems using vulnerability discovery data and then looks for behavioral signals: the query identifies rare PAM modules loaded into the authentication chain and process activity associated with Linux privilege escalation. An agent weighs the evidence to identify compromised hosts where an attacker transitioned to root or established persistent access. ## scope-vulnerable-hosts Identify hosts with known vulnerabilities targeted by the new Metasploit modules to focus the behavioral queries. ```sqlite target=endpoint role=scoping ~~~yaml expected: Rows identify hosts running vulnerable versions of snapd, Ollama, or relevant Linux kernels. Silence means no known vulnerable systems were reported. reads: - device_uid - cve_uid - affected_package_name - severity_id - title silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-10-10' ~~~ SELECT device_uid, cve_uid, affected_package_name, severity_id, title FROM hb_vulnerability_finding WHERE cve_uid IN ('CVE-2026-3888', 'CVE-2026-43503', 'CVE-2026-42249') ``` ## parallel-hunt parallel: - → rare-pam-modules - → exploit-behavior join: → triage-findings ## rare-pam-modules Find potentially malicious .so files loaded into the Linux authentication chain that indicate a PAM backdoor. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A module path seen on only one or two hosts. Genuine PAM modules should be present across the fleet; a backdoor will appear unique to the target. prevalence: by: device_hostname key: - module_path rare_below: 2 reads: - module_path - device_hostname - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-10-10' ~~~ SELECT module_path, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_module_activity WHERE (LOWER(module_path) LIKE '/lib/security/%.so' OR LOWER(module_path) LIKE '/usr/lib/security/%.so') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY module_path HAVING hosts <= 2 ORDER BY hosts ASC ``` ## exploit-behavior Detect the execution of LPE exploits, security software discovery, and Ollama configuration changes. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Processes mentioning exploit names or the Metasploit discovery module. Transition of these processes to root or processes with on_disk = 0 are high-confidence indicators. reads: - device_hostname - process_name - process_cmd_line - user_name - on_disk - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-10-10' ~~~ SELECT device_hostname, process_name, process_cmd_line, user_name, on_disk, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%snap-confine%' OR LOWER(process_cmd_line) LIKE '%dirtyclone%' OR LOWER(process_cmd_line) LIKE '%enum_protections%' OR LOWER(process_cmd_line) LIKE '%ollama%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC ``` ## triage-findings ```agent target=hunter cite: required context: - scope-vulnerable-hosts - rare-pam-modules - exploit-behavior max_iterations: 5 objective: Determine if any host shows a combination of vulnerability exposure, rare PAM modules, and exploit-related process activity indicative of privilege escalation or persistence. success_criteria: A verdict of malicious, suspicious, or benign per host with cited evidence from the process and module logs. tools: - endpoint ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host based on exploit execution or unauthorized PAM modules" (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → forensic-investigation unavailable: → forensic-investigation (blind_spot: no-file-telemetry) else: → close-out ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the compromised host from the network to prevent lateral movement or further persistence installation. ``` → forensic-investigation ## forensic-investigation ```manual target=analyst Perform a deep dive on the isolated host. Collect the rare PAM module if present, analyze the process tree leading to root transition, and check for any additional persistence mechanisms like cron jobs. ``` → close-out ## close-out ```manual target=analyst Document the findings, update vulnerability management records, and determine if the detection-candidate process query should be promoted to a standing alert. ``` → end