Mac OS X 10.9.5 / 10.10.5 rsh/libmalloc Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', 'Description' = %q This module writes to the sudoers file without...

Th3 MMA mma.php Backdoor Arbitrary File Upload Exploit

Exploit for php platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'nokogiri' class Metasploit3 'Th3 MMA mma.php Backdoor Arbitrary File Upload', 'Descriptio...

Th3 MMA mma.php Backdoor Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'nokogiri' class Metasploit3 'Th3 MMA mma.php Backdoor Arbitrary File Upload', 'Description' = %q This module exploits Th3 MMA mma.php Backdoor...

Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', 'Descriptio...

Apple Mac OSX 10.9.5/10.10.5 - 'rsh/libmalloc' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', 'Description' = %q This module writes to the sudoers file without...

Safari User-Assisted Applescript Exec Attack Exploit

Exploit for macOS platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Safari User-Assisted Applescript Exec Attack', 'Description' = %q In versions...

[ZDI-15-396] ManageEngine ServiceDesk Plus remote code execution

Hi, Yet another RCE bug in ManageEngine ServiceDesk. This was disclosed by ZDI under ID ZDI-15-396 on August 20th, and fixed in version 9103 1. Details below, full advisory can be obtained from my repo at E2. A Metasploit module that exploits this vulnerability has been submitted upstream in E3...

Safari User-Assisted Applescript Exec Attack

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Safari User-Assisted Applescript Exec Attack', 'Description' = %q In versions of Mac OS X before 10.11.1, the applescript:// URL...

Joomla com_contenthistory Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/contenthistorysqli msf undefinedcontenthistorysqli show actions ...actions... msf...

OpenVPN Gather Credentials

This module grab OpenVPN credentials from a running process in Linux. Note: --auth-nocache must not be set in the OpenVPN command line. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenVPN...

Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

Nibbleblog File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

Tomabo MP4 Player 3.11.6 - SEH Based Stack Overflow

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: Tomabo MP4 Player 3.11.6 SEH Based Stack Overflow Exploit Author: @yokoacc, @nudragn, @runggareksya Vendor Homepage: http://www.tomabo.com/ Software Link: http://www.tomabo.com/mp4-player/download.html...

Safari User-Assisted Applescript Exec Attack

In versions of Mac OS X before 10.11.1, the applescript:// URL scheme is provided, which opens the provided script in the Applescript Editor. Pressing cmd-R in the Editor executes the code without any additional confirmation from the user. By getting the user to press cmd-R in Safari, and by...

X11 Keyboard Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "\x0a", '2' = "\x0b", '3' = "\x0c", '4' = "\x0d", '5' = "\x0e", '6' = "\x0f", '7' = "\x10", '&' = "\x10", '8' = "\x11", '9' = "\x12",...

ElasticSearch Snapshot API Directory Traversal

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 'ElasticSearch Snapshot API Directory Traversal', 'Description' = %q This module exploits a directory traversal...

ElasticSearch Snapshot API Directory Traversal

'This module exploits a directory traversal vulnerability in ElasticSearch, allowing an attacker to read arbitrary files with JVM process privileges, through the Snapshot API.' This module requires Metasploit: https://metasploit.com/download Current source:...

Limesurvey Unauthenticated File Download

This module exploits an unauthenticated file download vulnerability in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded as a ZIP and unzipped automatically, thus binary files can be downloaded. Module Options msf use auxiliary/admin/http/limesurvey/filedownload msf...

Wordpress Ajax Load More PHP Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress Ajax Load More version 2.8.1.1. It allows to upload arbitrary php files and get remote code execution. This module has been tested successfully on WordPress Ajax Load More 2.8.0 with Wordpress 4.1.3 on Ubuntu 12.04/14.04 Server. Modul...

HP SiteScope DNS Tool Command Injection

This module exploits a command injection vulnerability discovered in HP SiteScope 11.30 and earlier versions tested in 11.26 and 11.30. The vulnerability exists in the DNS Tool allowing an attacker to execute arbitrary commands in the context of the service. By default, HP SiteScope installs and...