TigerVNC Detection (Windows SMB Login)

Detects the installed version of TigerVNC. The script logs in via smb, searches for TigerVNC in the registry and gets the version from registry. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...

Python Detection (SMB Login / Windows)

SMB login-based detection of Python on Windows. Copyright C 2011 Greenbone Networks GmbH, http://www.greenbone.net Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

kernel: xen: x86_64: fix error checking in arch_set_info_guest()

Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service host crash by specifying user mode execution without user-mode pagetables...

Citrix License Server Version Detection

This script finds the installed Citrix License Server version. The script logs in via smb, searches for Citrix in the registry and gets the version from SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

CVE-2011-0710

The taskshowregs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/...

CVE-2011-0710: Exposure of Sensitive Information to an Unauthorized Actor

The taskshowregs function in arch/s390/kernel/traps.c in the Linux kernel before 2.6.38-rc4-next-20110216 on the s390 platform allows local users to obtain the values of the registers of an arbitrary process by reading a status file under /proc/...

CVE-2010-4255

The fixuppagefault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handlegdtldtmappingfault function, which allows guest OS users to cause a denial of service host OS BUGON via a...

CVE-2010-4255: Undefined Security Weakness

The fixuppagefault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handlegdtldtmappingfault function, which allows guest OS users to cause a denial of service host OS BUGON via a...

PT-2011-1488

Name of the Vulnerable Software and Affected Versions Xen versions 4.0.1 and earlier Description The issue arises from the fixup page fault function in arch/x86/traps.c when paravirtualization is enabled on 64-bit platforms. It fails to verify that kernel mode is used to call the handle gdt ldt...

CVE-2010-3881

arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device...

CVE-2010-3881: Exposure of Sensitive Information to an Unauthorized Actor

arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device...

GNU inetutils 1.8-1 FTP Client Heap Overflow

Exploit for linux platform in category dos / poc ============================================ GNU inetutils 1.8-1 FTP Client Heap Overflow ============================================ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Title: GNU inetutils 1.8-1 ftp client Heap Overflow Date: Dec 07 20...

Command Shell, Java Reverse TCP Stager

Spawn a piped command shell cmd.exe on Windows, /bin/sh everywhere else. Connect back stager This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 5256 include Msf::Payload::Stager inclu...

CVE-2010-2070: Undefined Security Weakness

arch/ia64/xen/faults.c in Xen 3.4 and 4.0 in Linux kernel 2.6.18, and possibly other kernel versions, when running on IA-64 architectures, allows local users to cause a denial of service and "turn on BE by modifying the user mask of the PSR," as demonstrated via exploitation of CVE-2006-0742...

CPUID-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on CPUID and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'CPUID-based Context Keyed Payload Encoder',...

CVE-2010-1446: Undefined Security Weakness

arch/powerpc/mm/fslbookemmu.c in KGDB in the Linux kernel 2.6.30 and other versions before 2.6.33, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke...

CVE-2010-1451

The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain PAGEEXEC4U bit and consequently does not properly implement a non-executable stack, which makes it easier for context-dependent...

CVE-2010-1451: Out-of-bounds Write

The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain PAGEEXEC4U bit and consequently does not properly implement a non-executable stack, which makes it easier for context-dependent...

JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. Module Options msf use exploit/multi/http/jboss/bshdeployer msf...

Ipswitch WS_FTP Professional Detection (Windows SMB Login)

SMB login-based detection of Ipswitch WSFTP Professional. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...