Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow', 'Description' = %q This module exploits a stack based buffer overflow in...

MS14-012 Microsoft Internet Explorer TextRange Use-After-Free

This module exploits a use-after-free vulnerability found in Internet Explorer. The flaw was most likely introduced in 2013, therefore only certain builds of MSHTML are affected. In our testing with IE9, these vulnerable builds appear to be between 9.0.8112.16496 and 9.0.8112.16533, which implies...

Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow

This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability exists in the service BKBCopyD.exe when handling specially crafted packets. This module has been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3. Module Options msf use...

Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow

This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability exists in the service BKHOdeq.exe when handling specially crafted packets. This module has been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows 2003 SP2. Module...

ifwatchd Privilege Escalation

This module attempts to gain root privileges on QNX 6.4.x and 6.5.x systems by exploiting the ifwatchd suid executable. ifwatchd allows users to specify scripts to execute using the '-A' command line argument; however, it does not drop privileges when executing user-supplied scripts, resulting in...

SolidWorks Workgroup PDM 2014 - 'pdmwService.exe' Arbitrary File Write (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write', 'Description' = %q This module exploits a remote arbitrary file...

Yokogawa CENTUM CS 3000 BKCLogSvr.exe Heap Buffer Overflow

This module abuses a buffer overflow vulnerability to trigger a Denial of Service of the BKCLogSvr component in the Yokogaca CENTUM CS 3000 product. The vulnerability exists in the handling of malformed log packets, with an unexpected long level field. The root cause of the vulnerability is a...

HP Data Protector - Backup Client Service Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'HP Data Protector Backup Client Service Remote Code Execution', 'Description' = %q This module abuses the Backup Client Service...

Yokogawa CS3000 BKESimmgr.exe Buffer Overflow

This module exploits an stack based buffer overflow on Yokogawa CS3000. The vulnerability exists in the BKESimmgr.exe service when handling specially crafted packets, due to an insecure usage of memcpy, using attacker controlled data as the size count. This module has been tested successfully in...

GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution

GetGo Download Manager 4.9.0.1982 - HTTP Response Header Buffer Overflow Remote Code Execution !/usr/bin/python Exploit Title: GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution Version: v4.9.0.1982 CVE: CVE-2014-2206 Date: 2014-03-09 Author: Julien Ahrens @MrTuxrac...

GetGo Download Manager 4.9.0.1982 Buffer Overflow

!/usr/bin/python Exploit Title: GetGo Download Manager HTTP Response Header Buffer Overflow Remote Code Execution Version: v4.9.0.1982 CVE: CVE-2014-2206 Date: 2014-03-09 Author: Julien Ahrens @MrTuxracer Homepage: http://www.rcesecurity.com Software Link: http://www.getgosoft.com Tested on: WinX...

Safari User-Assisted Download / Run Attack

This Metasploit module abuses some Safari functionality to force the download of a zipped .app OSX application containing our payload. The app is then invoked using a custom URL scheme. At this point, the user is presented with Gatekeeper's prompt: "APPNAME" is an application downloaded from the...

Dell KACE K1000 File Upload

This module exploits a file upload vulnerability in Kace K1000 versions 5.0 to 5.3, 5.4 prior to 5.4.76849 and 5.5 prior to 5.5.90547 which allows unauthenticated users to execute arbitrary commands under the context of the 'www' user. This module also abuses the 'KSudoClient::RunCommandWait'...

Safari User-Assisted Download / Run Attack

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Safari User-Assisted Download & Run...

Windows Meterpreter (Reflective Injection), Reverse HTTP Stager Proxy

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModu...

Reflective DLL Injection, Reverse HTTP Stager Proxy

Inject a DLL via a reflective loader. Tunnel communication over HTTP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 665 include Msf::Payload::Stager include Msf::Payload::Windows...

VNC Server (Reflective Injection), Reverse HTTP Stager Proxy

Inject a VNC Dll via a reflective loader staged. Tunnel communication over HTTP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 665 include Msf::Payload::Stager include...

SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write', 'Description' = %q This module exploits a remote arbitrary file...

SolidWorks Workgroup PDM 2014 Arbitrary File Write Exploit

This Metasploit module exploits a remote arbitrary file write vulnerability in SolidWorks Workgroup PDM 2014 SP2 and prior. For targets running Windows Vista or newer the payload is written to the startup folder for all users and executed upon next user logon. For targets before Windows Vista cod...

Huawei E355 contains a direct request vulnerability

Overview Huawei E355 USB WiFi adapter with firmware version: 21.157.37.01.910 has been reported to contain a direct request vulnerability in the web interface. CWE-425 Description Huawei E355 USB WiFi adapter with firmware version: 21.157.37.01.910 has been reported to contain a direct request...