13630 matches found
Movable Type 7 r.5002 - XMLRPC API OS Command Injection (Metasploit)
class MetasploitModule "Movable Type XMLRPC API Remote Command Injection", 'Description' = %q This module exploit Movable Type XMLRPC API Remote Command Injection. , 'License' = MSFLICENSE, 'Author' = 'Etienne Gervais', author & msf module, 'Charl-Alexandre Le Brun' author & msf module ,...
DNN (DotNetNuke) 9.2 <= 9.2.2 Weak Encryption Algorithm Vulnerability
The version of DNN Platform formerly DotNetNuke running on the remote host is 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...
Browse the session filesystem in a Web Browser
This module allows you to browse the session filesystem via a local browser window. Module Options msf use post/multi/manage/fileshare msf postfileshare show actions ...actions... msf postfileshare set ACTION msf postfileshare show options ...show and set options... msf postfileshare run This...
Exploit for Path Traversal in Microsoft
CVE-2021-40444-POC An attempt to reproduce Microsoft MSHTML Re...
Exploit for Path Traversal in Microsoft
CVE-2021-40444-POC An attempt to reproduce Microsoft MSHTML Re...
Exploit for Path Traversal in Microsoft
CVE-2021-40444-POC An attempt to reproduce Microsoft MSHTML Re...
Microsoft OMI Management Interface Authentication Bypass
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/SCXOperatingSystem' .freeze def initializeinfo = super updateinfo info, 'Name' = 'Microsoft OMI...
Zimbra zmslapd arbitrary module load
This module exploits CVE-2022-37393, which is a vulnerability in Zimbra's sudo configuration that permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes...
Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution Exploit
This Metasploit module exploits an unauthenticated remote code execution vulnerability which exists in Apache version 2.4.49 CVE-2021-41773. If files outside of the document root are not protected by ‘require all denied’ and CGI has been explicitly enabled, it can be used to execute arbitrary...
Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache 2.4.49/2.4.50 Traversal RCE', 'Description' = %q This module exploit an unauthenticated RCE vulnerability which exists in Apache version...
Exploit for Path Traversal in Vmware Cloud_Foundation
CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about...
Metasploit Wrap-Up
We just couldn't contain ourselves! This week we've got two Kubernetes modules coming at you from adfoster-r7 and smcintyre-r7. First up is an enum module auxiliary/cloud/kubernetes/enumkubernetes that'll extract a variety of information including the namespaces, pods, secrets, service token...
TA551 Shifts Tactics to Install Sliver Red-Teaming Tool
The criminal threat group known as TA551 has added the Sliver red-teaming tool to its bag of tracks – a move that may signal ramped up ransomware attacks ahead, researchers said. According to Proofpoint researchers, TA551 aka Shathak has been mounting cyberattacks that start with email thread...
Exploit for Deserialization of Untrusted Data in Veeam One
Modified-CVE-2020-10915-MsfModule THIS IS NOT AN ORIGINAL EXPL...
Fresh APT Harvester Reaps Telco, Government Data
A previously unseen advanced persistent threat APT group dubbed Harvester by researchers is attacking telcos, IT companies and government-sector targets in a campaign that’s been ongoing since June. According to a Symantec analysis, the group sports a veritable cornucopia of advanced and custom...
Metasploit Wrap-Up
An Especially Spooky Season for Moodle This release has not one, two, or three, but FOUR authenticated Moodle exploit modules, or should I say moodules? H00die comes through again with not just modules, but also an artisanal, bespoke library to support further work. Two target the spell check...
Moodle SpellChecker Path Authenticated Remote Command Execution Exploit
Moodle allows an authenticated administrator to define spellcheck settings via the web interface. An administrator can update the aspell path to include a command injection. This is extremely similar to CVE-2013-3630, just using a different variable. This Metasploit module was tested against Mood...
Moodle Authenticated Spelling Binary Remote Code Execution Exploit
Moodle allows an authenticated user to define spellcheck settings via the web interface. The user can update the spellcheck mechanism to point to a system-installed aspell binary. By updating the path for the spellchecker to an arbitrary command, an attacker can run arbitrary commands in the...
Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution Exploit
Moodle versions 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12, and earlier unsupported versions allow for a teacher to exploit chain to remote code execution. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other users, and...
Moodle Admin Shell Upload Exploit
This Metasploit module will generate a plugin which can receive a malicious payload request and upload it to a server running Moodle provided valid admin credentials are used. Then the payload is sent for execution, and the plugin uninstalled. You must have an admin account to exploit this...