metasploit-info NSE Script

Gathers info from the Metasploit rpc service. It requires a valid login pair. After authentication it tries to determine Metasploit version and deduce the OS type. Then it creates a new console and executes few commands to get additional info. References: Metasploit RPC API Guide See also:...

Samba SetInformationPolicy AuditEventsInfo Heap Overflow

This module triggers a vulnerability in the LSA RPC service of the Samba daemon because of an error on the PIDL auto-generated code. Making a specially crafted call to SetInformationPolicy to set a PolicyAuditEventsInformation allows to trigger a heap overflow and finally execute arbitrary code...

Advantech / BroadWin WebAccess webvrpcs.exe Service Remote Code Execution (uncredentialed check) (deprecated)

The Advantech / BroadWin WebAccess software installed on the remote Windows host includes an RPC service webvrpcs.exe that listens remotely on TCP port 4592. It is affected by two vulnerabilities : - An overflow condition exists due to improper validation of user-supplied input. An unauthenticate...

Advantech / BroadWin WebAccess webvrpcs.exe Service Remote Code Execution (credentialed check)

Binary data scadaadvantechwebaccessrcelocal.nbin...

Multiple Vendors Calendar Manager RPC Service Memory Corruption (CVE-2010-4435)

A memory corruption vulnerability has been reported in IBM's, Hewlett-Packard's and Sun Microsystems calendar manager product. The vulnerability is due to an error in the Calendar Manager Service Daemon rpc.cmsd when handling RPC requests...

ZDI-11-062: Multiple Vendor Calendar Manager RPC Service Remote Code Execution Vulnerability

ZDI-11-062: Multiple Vendor Calendar Manager RPC Service Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-062 February 8, 2011 -- CVE ID: CVE-2010-4435 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Hewlett-Packard IBM Sun Microsystems -- Affect...

Rocket Software UniData/UniVerse unirpc32.dll Uni RPC Service Packet Header Remote Overflow

According to its reported version, the Rocket Software UniVerse or UniData install on the remote Windows host is affected by a buffer overflow vulnerability. The application fails to properly validate a size value in a RPC packet header before using it to determine the number of bytes to receive...

Null pointer dereference

The Netlogon RPC Service in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, and R2, when the domain controller role is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a crafted RPC packet, aka "Netlogon RPC Null dereference DOS...

CVE-2010-2742

The Netlogon RPC Service in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, and R2, when the domain controller role is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and reboot via a crafted RPC packet, aka "Netlogon RPC Null dereference DOS...

Microsoft Windows Netlogon Service Denial of Service Vulnerability (2207559)

This host is missing a critical security update according to Microsoft Bulletin MS10-101. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Windows Netlogon Service Denial of Service Vulnerability (2207559)

This host is missing a critical security update according to Microsoft Bulletin MS10-101. OpenVAS Vulnerability Test $Id: secpodms10-101.nasl 5361 2017-02-20 11:57:13Z cfi $ Microsoft Windows Netlogon Service Denial of Service Vulnerability 2207559 Authors: Antu Sanadi Copyright: Copyright c 2010...

MS10-101: Vulnerability in Windows Netlogon Service Could Allow Denial of Service (2207559)

The remote Windows host contains a version of the NetLogon RPC service that is affected by a denial of service vulnerability. An attacker with administrative privileges on a machine that is joined to the same domain as the affected domain controller could cause a denial of service by sending a...

Microsoft Print Spooler Service Impersonation Vulnerability

$Id: ms10061spoolss.rb 10391 2010-09-20 05:06:51Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability

This module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is...

MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)

This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. This modul...

Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overflow (Metasploit)

$Id: lsatransnamesheap.rb 9828 2010-07-14 17:27:23Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit)

$Id: lsatransnamesheap.rb 9021 2010-04-05 23:34:10Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

SMB User Enumeration (SAM EnumUsers)

Determine what users exist via the SAM RPC service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB User Enumeration SAM EnumUsers', 'Description' = 'Determine what users exist via the SAM R...

CA BrightStor ArcServe Media Service Stack Overflow

require 'msf/core' class Metasploit3 'CA BrightStor ArcServe Media Service Stack Overflow', 'Description' = %q This exploit targets a stack overflow in the MediaSrv RPC service of CA BrightStor Arcserve. By sending a specially crafted SUNRPC request, an attacker can overflow a stack buffer and...

iDefense Security Advisory 10.07.09: IBM AIX rpc.cmsd Stack Buffer Overflow Vulnerability

iDefense Security Advisory 10.07.09 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 07, 2009 I. BACKGROUND IBM's AIX is a Unix operating system based on System V, which runs on the PowerPC PPC architecture. For more information, visit the product web site at the following URL...