Moodle Authenticated Spelling Binary Remote Code Execution Exploit

Moodle allows an authenticated user to define spellcheck settings via the web interface. The user can update the spellcheck mechanism to point to a system-installed aspell binary. By updating the path for the spellchecker to an arbitrary command, an attacker can run arbitrary commands in the...

Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution Exploit

Moodle versions 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12, and earlier unsupported versions allow for a teacher to exploit chain to remote code execution. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other users, and...

Moodle SpellChecker Path Authenticated Remote Command Execution Exploit

Moodle allows an authenticated administrator to define spellcheck settings via the web interface. An administrator can update the aspell path to include a command injection. This is extremely similar to CVE-2013-3630, just using a different variable. This Metasploit module was tested against Mood...

KB5006674: Windows 11 Security Update (October 2021)

The remote Windows host is missing security update 5006674. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

Moodle Admin Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Moodle Admin Shell Upload', 'Description' = %q This module will generate a plugin which can receive a malicious payload request and upload it to ...

KB5006715: Windows Server 2008 Security Update (October 2021)

The remote Windows host is missing security update 5006715. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

KB5006732: Windows Server 2012 Security Update (October 2021)

The remote Windows host is missing security update 5006732. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself i...

KB5006699: Windows Server 2022 Security Update (October 2021)

The remote Windows host is missing security update 5006699. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

WordPress Plugin Pie Register Auth Bypass to RCE

This module uses an authentication bypass vulnerability in Wordpress Plugin Pie Register use exploit/unix/webapp/wp/pieregisterbypassrce msf undefinedpieregisterbypassrce show actions ...actions... msf undefinedpieregisterbypassrce set ACTION msf undefinedpieregisterbypassrce show options ...show...

Netfilter x_tables Heap Out-Of-Bounds Write / Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netfilter xtables Heap OOB Write Privilege Escalation', 'Description' = %q A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773|CVE-2021-42013: Path Traversal Zero-Day in Apac...

Diagnostic State

This module will keep the vehicle in a diagnostic state on rounds by sending tester present packet. Module Options msf use post/hardware/automotive/diagnosticstate msf postdiagnosticstate show actions ...actions... msf postdiagnosticstate set ACTION msf postdiagnosticstate show options ...show an...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about...

Metasploit Wrap-Up

Credential gatherers, mix-ins, oh my! We're excited that Metasploit now includes support for 28 related post modules for gathering credentials based on the PackRat toolset. This is a continuation of 5433, 11700, and 11719. It was developed by community contributors Kazuyoshi Maruta, Daniel...

Kubernetes authenticated code execution

Execute a payload within a Kubernetes pod. Module Options msf use exploit/multi/kubernetes/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedexec show options ...show and set options... msf undefinedexec run -- coding: binary -- This module requires...

Exploit for CVE-2017-0144

This is a PoC exploit for CVE-2017-0144, also known as the EternalBlue vulnerability, which is a remote code execution vulnerability in the Windows SMBv1 protocol. The exploit is implemented as a Metasploit module, and it targets the Double Pulsar backdoor. The target product/service is the Windo...

ECU Hard Reset

This module performs hard reset in the ECU Reset Service Identifier 0x11. Module Options msf use post/hardware/automotive/ecuhardreset msf postecuhardreset show actions ...actions... msf postecuhardreset set ACTION msf postecuhardreset show options ...show and set options... msf postecuhardreset...

Thunderbird Credential Gatherer

This module searches for Thunderbird credentials on a Windows host. Module Options msf use post/windows/gather/credentials/thunderbird msf postthunderbird show actions ...actions... msf postthunderbird set ACTION msf postthunderbird show options ...show and set options... msf postthunderbird run...

Postbox Credential Gatherer

This module searches for Postbox credentials on a Windows host. Module Options msf use post/windows/gather/credentials/postbox msf postpostbox show actions ...actions... msf postpostbox set ACTION msf postpostbox show options ...show and set options... msf postpostbox run This module requires...

Maxthon Credential Gatherer

This module searches for Maxthon credentials on a Windows host. Module Options msf use post/windows/gather/credentials/maxthon msf postmaxthon show actions ...actions... msf postmaxthon set ACTION msf postmaxthon show options ...show and set options... msf postmaxthon run This module requires...