Sn1per v5.0 - Automated Pentest Recon Scanner

Sn1per Community Edition is an automated scanner that can be used during a penetration test to enumerate and scan for vulnerabilities. Sn1per Professional is Xero Security's premium reporting addon for Professional Penetration Testers, Bug Bounty Researchers and Corporate Security teams to manage...

Geutebruck 5.02024 G-Cam/EFD-2250 - simple_loglistjs.cgi Remote Command Execution Exploit

This Metasploit module exploits a an arbitrary command execution vulnerability. The vulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows an anonymous user to execute arbitrary commands with root privileges. Firmware 'Geutebruck simpleloglistjs.cgi Remote Command...

CMS Made Simple Authenticated RCE via File Upload/Copy

CMS Made Simple allows an authenticated administrator to upload a file and rename it to have a .php extension. The file can then be executed by opening the URL of the file in the /uploads/ directory. This module has been successfully tested on CMS Made Simple versions 2.2.5 and 2.2.7. Module...

Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", 'Description' = %q This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter...

Boxoft WAV To MP3 Converter 1.1 Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", 'Description' = %q This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter...

Geutebruck simple_loglistjs.cgi Remote Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Geutebruck simpleloglistjs.cgi Remote Command Execution', 'Description' = %q This module exploits a an arbitrary command execution vulnerability...

Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow

This module exploits a stack based buffer overflow in Delta Electronics Delta Industrial Automation COMMGR 1.08. The vulnerability exists in COMMGR.exe when handling specially crafted packets. This module has been tested successfully on Delta Electronics Delta Industrial Automation COMMGR 1.08 ov...

Nagios XI Chained Remote Code Execution Exploit

This Metasploit module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to gain remote root access. The steps are: 1. Issue a POST request to /nagiosql/admin/settings.php which sets the database user to root. 2. SQLi on /nagiosql/admin/helpedit.php allows us to enumerate API key...

FTPShell Client 6.70 Enterprise Edition Stack Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTPShell client 6.70 Enterprise edition Stack Buffer Overflow', 'Description' = %q This module exploits a buffer overflow in the FTPShell client...

ManageEngine Exchange Reporter Plus Unauthenticated RCE

This module exploits a remote code execution vulnerability that exists in Exchange Reporter Plus use exploit/windows/http/manageengine/adshaclusterrce msf undefinedadshaclusterrce show actions ...actions... msf undefinedadshaclusterrce set ACTION msf undefinedadshaclusterrce show options ...show...

Quest KACE Systems Management - Command Injection Exploit

Exploit for unix platform in category remote exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Quest KACE Systems Management Command Injection', 'Description' = %q This module exploits a...

Quest KACE Systems Management - Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Quest KACE Systems Management Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Quest KACE Systems...

Executing Meterpreter on Windows 10 and Bypassing Antivirus

One of my Labs colleagues recently published an article on the Coalfire Blog about executing an obfuscated PowerShell payload using Invoke-CradleCrafter. This was very useful, as Windows Defender has upped its game lately and is now blocking Metasploits Web Delivery module. I wanted to demonstrat...

Unauthenticated Privileged Directory Traversal in IPConfigure Orchid Core VMS(CVE-2018-10956)

Affected Software: IPConfigure Orchid Core VMS All versions 2.0.6, tested on Linux and Windows Vulnerability: Unauthenticated Privileged Directory Traversal CVE: CVE-2018-10956 Impact: Arbitrary File Read Access Metasploit module:...

IPConfigure Orchid VMS 2.0.5 - Directory Traversal Information Disclosure (Metasploit)

IPConfigure Orchid VMS 2.0.5 - Directory Traversal Information Disclosure Metasploit require 'msf/core' class MetasploitModule 'IPConfigure Orchid VMS %q Orchid Core VMS is vulnerable to a directory traversal attack. This affects Linux and Windows operating systems. This allows a remote,...

Pseudo-Shell Post-Exploitation Module

This module will run a Pseudo-Shell. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'readline' class MetasploitModule Msf::Post include Msf::Post::File include Msf::Post::Unix include Msf::Post::Linux::System...

phpMyAdmin Authenticated Remote Code Execution

phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. The module has been tested with phpMyAdmin v4.8.1. Module Options msf use exploit/multi/http/phpmyadmin/lfirce msf undefinedlfirce show actions...

phpMyAdmin 4.x Remote Code Execution Exploit

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pregreplace aka eval modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table...

Httpdasm Directory Traversal

This module allows for traversing the file system of a host running httpdasm v0.92. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Httpdasm Directory Traversal', 'Description' = %q This module...

Multi Manage the screensaver of the target computer

This module allows you to turn on or off the screensaver of the target computer and also lock the current session. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Manage the screensaver o...