Sun Java Web Start Double Quote Injection Vulnerability

This Metasploit module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. Parameters intial-heap-size and max-heap-size in a JNLP file can contain a double quote which is not properly sanitized when creating the command line for javaw.exe. This allows the injection of...

Mac OS X 10.7 / 10.8 Unauthorized File Access (remote check)

The remote Mac OS X host is affected by an unauthorized file access vulnerability. If SMB file sharing is enabled, an authenticated user may be able to write files outside the shared directory. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66836; scriptversion"2.2";...

Design/Logic Flaw

SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors...

CVE-2013-0990

SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors...

CVE-2013-0990

CVE-2013-0990 affects Apple Mac OS X before 10.8.4 when SMB file sharing is enabled. An authenticated remote user may write or modify files outside the shared directory via unspecified vectors due to SMB access control weaknesses. The issue is documented across multiple sources (NVD/NVD 2013-0990...

Mac OS X 10.8 < 10.8.4 Multiple Vulnerabilities (Security Update 2013-002)

Binary data 6857.prm...

Mac OS X 10.8.x < 10.8.4 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.4. The newer version contains multiple security-related fixes for the following components : - CFNetwork - CoreAnimation - CoreMedia Playback - CUPS - Disk Management - OpenSSL - QuickDraw Manager - QuickTime - SMB C...

Mac OS X Multiple Vulnerabilities (Security Update 2013-002)

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied. This update contains numerous security-related fixes for the following components : - CoreMedia Playback 10.7 only - Directory Service 10.6 only - OpenSSL - QuickDraw Manager -...

SAP SMB Relay Abuse

This module exploits provides several SMB Relay abuse through different SAP services and functions. The attack is done through specially crafted requests including a UNC Path which will be accessing by the SAP system while trying to process the request. In order to get the hashes the...

Microsoft Lync Server Version Detection

Detects the installed version of Microsoft Lync Server. The script logs in via smb, searches for Microsoft Lync Server in the registry and gets the version from Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

Microsoft Windows SMB Client Repeated Negotiation Responses (MS10-006) - High Confidence (CVE-2010-0017)

A remote code execution vulnerability has been reported in the Microsoft Server Message Block SMB Protocol. The vulnerability is due to a race condition in the Microsoft SMB implementation that fails to properly handle specially crafted SMB responses. A remote attacker could exploit this flaw by...

SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure

This module abuses the SAP NetWeaver EPSGETDIRECTORYLISTING function, on the SAP SOAP RFC Service, to check for remote directory existence and get the number of entries on it. The module can also be used to capture SMB hashes by using a fake SMB share as DIR. This module requires Metasploit:...

SAP SOAP EPS_DELETE_FILE File Deletion

This module abuses the SAP NetWeaver EPSDELETEFILE function, on the SAP SOAP RFC Service, to delete arbitrary files on the remote file system. The module can also be used to capture SMB hashes by using a fake SMB share as DIRNAME. This module requires Metasploit: https://metasploit.com/download...

SAP SOAP RFC PFL_CHECK_OS_FILE_EXISTENCE File Existence Check

This module abuses the SAP NetWeaver PFLCHECKOSFILEEXISTENCE function, on the SAP SOAP RFC Service, to check for files existence on the remote file system. The module can also be used to capture SMB hashes by using a fake SMB share as FILEPATH. This module requires Metasploit:...

SAP SOAP RFC RZL_READ_DIR_LOCAL Directory Contents Listing

This module exploits the SAP NetWeaver RZLREADDIRLOCAL function, on the SAP SOAP RFC Service, to enumerate directory contents. It returns only the first 32 characters of the filename since they are truncated. The module can also be used to capture SMB hashes by using a fake SMB share as DIR. This...

USN-1802-1: Samba vulnerability

It was discovered that Samba incorrectly handled CIFS share attributes when SMB2 was used. A remote authenticated user could possibly gain write access to certain shares, bypassing the intended permissions...

Options for Brute Force NVTs

This VT sets some options for the brute force / default credentials checks. - Disable brute force checks: Disables the brute force checks done by the following VTs: HTTP Brute Force Logins With Default Credentials OID: 1.3.6.1.4.1.25623.1.0.108041 SSH Brute Force Logins With Default Credentials...

Windows Gather Microsoft Office Word UNC Path Injector

This module modifies a remote .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. Verified to work with Microsoft Word 2003, 2007, 2010, and 2013. In order to get the hashes the auxiliary/server/capture/smb module can be used. This module requires Metasploit:...

SAP NetWeaver CA-CL SMB中继任意文件泄露漏洞

BUGTRAQ ID: 58612 SAP NetWeaver是下一代基于服务的平台，它将作为未来所有SAP应用程序的基础。 SAP NetWeaver 7.30及其他版本在Classification CA-CL内存在不明细节错误，通过SMB中继攻击SMB Relay attack，攻击者可利用此漏洞获取SAP服务器文件系统上的任意文件。 0 SAP NetWeaver 7.3 厂商补丁： SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sap.com/platform/netweaver/index.epx...

PsExec NTDS.dit And SYSTEM Hive Download Utility

This module authenticates to an Active Directory Domain Controller and creates a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM hive copy can be used in combination with other tools for...