Samba trans2open Overflow (*BSD x86)

This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the flaw on x86 Linux systems that do not have the noexec stack option set. Module Options msf use exploit/freebsd/samba/trans2open msf undefinedtrans2open show actions...

Webster HTTP Server GET Buffer Overflow

This exploits a stack buffer overflow in the Webster HTTP server. The server and source code was released within an article from the Microsoft Systems Journal in February 1996 titled "Write a Simple HTTP-based Server Using MFC and Windows Sockets". Module Options msf use...

TFTPD32 Long Filename Buffer Overflow

This module exploits a stack buffer overflow in TFTPD32 version 2.21 and prior. By sending a request for an overly long file name to the tftpd32 server, a remote attacker could overflow a buffer and execute arbitrary code on the system. Module Options msf use...

Savant 3.1 Web Server Overflow

This module exploits a stack buffer overflow in Savant 3.1 Web Server. The service supports a maximum of 10 threads for a default install. Each exploit attempt generally causes a thread to die whether successful or not. Therefore, in a default configuration, you only have 10 chances. Due to the...

MS02-039 Microsoft SQL Server Resolution Overflow

This is an exploit for the SQL Server 2000 resolution service buffer overflow. This overflow is triggered by sending a udp packet to port 1434 which starts with 0x04 and is followed by long string terminating with a colon and a number. This module should work against any vulnerable SQL Server 200...

Solaris dtspcd Heap Overflow

This is a port of noir's dtspcd exploit. This module should work against any vulnerable version of Solaris 8 sparc. The original exploit code was published in the book Shellcoder's Handbook. Module Options msf use exploit/solaris/dtspcd/heap/noir msf undefinednoir show actions ...actions... msf...

Oracle 8i TNS Listener SERVICE_NAME Buffer Overflow

This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long SERVICENAME to the TNS service, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/oracle/tns/servicename msf undefinedservicename show actions...

Solaris in.telnetd TTYPROMPT Buffer Overflow

This module uses a buffer overflow in the Solaris 'login' application to bypass authentication in the telnet daemon. Module Options msf use exploit/solaris/telnet/ttyprompt msf undefinedttyprompt show actions ...actions... msf undefinedttyprompt set ACTION msf undefinedttyprompt show options...

Network Associates PGP KeyServer 7 LDAP Buffer Overflow

This module exploits a stack buffer overflow in the LDAP service that is part of the NAI PGP Enterprise product suite. This module was tested against PGP KeyServer v7.0. Due to space restrictions, egghunter is used to find our payload - therefore you may wish to adjust WfsDelay. Module Options ms...

MS01-033 Microsoft IIS 5.0 IDQ Path Overflow

This module exploits a stack buffer overflow in the IDQ ISAPI handler for Microsoft Index Server. Module Options msf use exploit/windows/iis/ms01/033idq msf undefined033idq show actions ...actions... msf undefined033idq set ACTION msf undefined033idq show options ...show and set options... msf...

HP OpenView OmniBack II Command Execution

This module uses a vulnerability in the OpenView Omniback II service to execute arbitrary commands. This vulnerability was discovered by DiGiT and his code was used as the basis for this module. For Microsoft Windows targets, due to module limitations, use the "unix/cmd/generic" payload and set C...

WinVNC Web Server GET Overflow

This module exploits a buffer overflow in the AT&T WinVNC version use exploit/windows/vnc/winvnc/httpget msf undefinedhttpget show actions ...actions... msf undefinedhttpget set ACTION msf undefinedhttpget show options ...show and set options... msf undefinedhttpget run This module requires...

MS00-094 Microsoft IIS Phone Book Service Overflow

This is an exploit for the Phone Book Service /pbserver/pbserver.dll described in MS00-094. By sending an overly long URL argument for phone book updates, it is possible to overwrite the stack. This module has only been tested against Windows 2000 SP1. Module Options msf use...

GAMSoft TelSrv 1.5 Username Buffer Overflow

This module exploits a username sprintf stack buffer overflow in GAMSoft TelSrv 1.5. Other versions may also be affected. The service terminates after exploitation, so you only get one chance! Module Options msf use exploit/windows/telnet/gamsoft/telsrvusername msf undefinedtelsrvusername show...

UoW pop2d Remote File Retrieval Vulnerability

This module exploits a vulnerability in the FOLD command of the University of Washington ipop2d service. By specifying an arbitrary folder name it is possible to retrieve any file which is world or group readable by the user ID of the POP account. This vulnerability can only be exploited with a...

WU-FTPD SITE EXEC/INDEX Format String Vulnerability

This module exploits a format string vulnerability in versions of the Washington University FTP server older than 2.6.1. By executing specially crafted SITE EXEC or SITE INDEX commands containing format specifiers, an attacker can corrupt memory and execute arbitrary code. Module Options msf use...

UoW IMAP Server LSUB Buffer Overflow

This module exploits a buffer overflow in the 'LSUB' command of the University of Washington IMAP service. This vulnerability can only be exploited with a valid username and password. Module Options msf use exploit/linux/imap/imap/uwlsub msf undefineduwlsub show actions ...actions... msf...

RedHat Piranha Virtual Server Package passwd.php3 Arbitrary Command Execution

This module abuses two flaws - a metacharacter injection vulnerability in the HTTP management server of RedHat 6.2 systems running the Piranha LVS cluster service and GUI rpm packages: piranha and piranha-gui. The vulnerability allows an authenticated attacker to execute arbitrary commands as the...

Matt Wright guestbook.pl Arbitrary Command Execution

The Matt Wright guestbook.pl use exploit/unix/webapp/guestbook/ssiexec msf undefinedssiexec show actions ...actions... msf undefinedssiexec set ACTION msf undefinedssiexec show options ...show and set options... msf undefinedssiexec run This module requires Metasploit:...

War-FTPD 1.65 Username Overflow

This module exploits a buffer overflow found in the USER command of War-FTPD 1.65. Module Options msf use exploit/windows/ftp/warftpd/165user msf undefined165user show actions ...actions... msf undefined165user set ACTION msf undefined165user show options ...show and set options... msf...