Weekly Metasploit Update: NTLM Relay Priv Esc, MCP Server Integration, Paperclip AI RCE Chain, and more
2026-06-21T19:24:17Z•a72b0301d81387021ae5a70efc7863d8b839a5a058dc3441b9565a0022fb2d85
AI assistanceCVE-2026-41679DLL side-loadingDonut shellcodeDropping ElephantFondue.exeKerberosMCP serverNIS2NTLM relayPsExecS4U2ProxyShadow CredentialsVS Code persistenceXerte Online Toolkitscompliancecontrol-flow flatteningin-memory RATincident reportingmetasploitpaperclipunauthenticated RCE
What happened
Rapid7 posts a Metasploit weekly update with five new modules, notably an unauthenticated full RCE against Paperclip AI (CVE-2026-41679) exploitable with a six-API-call chain, and a windows/local/ntlm_relay_2_self post‑exploitation module that coerces machine authentication via WebDAV, relays NTLM to a Domain Controller LDAP service, writes Shadow Credentials and uses S4U2Proxy to obtain a Kerberos service ticket for Administrator, enabling PsExec for SYSTEM. The release also adds MCP server integration (AI assistance within msfconsole), VS Code extension persistence technique, and other new/“
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- a72b0301d81387021ae5a70efc7863d8b839a5a058dc3441b9565a0022fb2d85
- Enrichment time
- 2026-06-21T19:24:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.