{"uuid": "2e654847-33a5-45ec-a153-f1c4deb1a2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-6127", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/empire_skywalker.rb", "content": "{\"aliases\": [], \"arch\": \"python, x86, x64\", \"author\": [\"Spencer McIntyre\", \"Erik Daguerre\", \"ACE-Responder\", \"Takahiro Yokoyama\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"A vulnerability existed in the new Empire (maintained by BC Security)\\n          prior to commit e73e883 (<v5.9.3) or the original PowerShellEmpire\\n          server prior to commit f030cf62 which would allow an arbitrary file\\n          to be written to an attacker controlled location with the permissions\\n          of the Empire server.\\n\\n          This exploit will write the payload to /tmp/ directory followed by a\\n          cron.d file to execute the payload.\", \"disclosure_date\": \"2016-10-15\", \"fullname\": \"exploit/linux/http/empire_skywalker\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"PowerShellEmpire Arbitrary File Upload (Skywalker)\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/empire_skywalker.rb\", \"platform\": \"Linux,Python\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/empire_skywalker\", \"references\": [\"CVE-2024-6127\", \"URL-https://blog.harmj0y.net/empire/empire-fails/\", \"URL-https://aceresponder.com/blog/exploiting-empire-c2-framework\", \"URL-https://github.com/ACE-Responder/Empire-C2-RCE-PoC/tree/main\"], \"rport\": 8080, \"session_types\": false, \"targets\": [\"Python\", \"Linux x86\", \"Linux x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:32.263774Z"}