CMS Made Simple 2.2.5 Authenticated Remote Command Execution Exploit

CMS Made Simple version 2.2.5 allows an authenticated administrator to upload a file and rename it to have a .php extension. The file can then be executed by opening the URL of the file in the /uploads/ directory. This module requires Metasploit: https://metasploit.com/download Current source:...

QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "QNAP Q'Center changepasswd Command Execution", 'Description' = %q This module exploits a command injection vulnerability in the changepasswd API...

Microsoft Windows #MicrosoftWindows POP/MOV SS Local Privilege Elevation Exploit

This Metasploit module exploits a vulnerability in a statement in the system programming guide of the Intel 64 and IA-32 architectures software developer's manual being mishandled in various operating system kernels, resulting in unexpected behavior for DB exceptions that are deferred by MOV SS o...

Microsoft Windows - POP/MOV SS Local Privilege Elevation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/common' require 'msf/core/post/file' require 'msf/core/post/windows/priv' require 'msf/core/post/windows/registry' require 'msf/core/exploit/exe'...

Dicoogle PACS Web Server Directory Traversal

This module exploits an unauthenticated directory traversal vulnerability in the Dicoogle PACS Web Server v2.5.0 and possibly earlier, allowing an attacker to read arbitrary files with the web server privileges. While the application is java based, the directory traversal was only successful...

HP VAN SDN Controller Root Command Injection Exploit

This Metasploit module exploits a hardcoded service token or default credentials in HPE VAN SDN Controller versions 2.7.18.0503 and below to execute a payload as root. A root command injection was discovered in the uninstall action's name parameter, obviating the need to use sudo for privilege...

Boxoft WAV To MP3 Converter 1.1 Buffer Overflow Exploit

This Metasploit module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter versions 1.0 and 1.1. By constructing a specially crafted WAV file and attempting to convert it to an MP3 file in the application, a buffer is overwritten, which allows for running shellcode. This module requir...

CMS Made Simple Authenticated RCE via File Upload/Copy

CMS Made Simple allows an authenticated administrator to upload a file and rename it to have a .php extension. The file can then be executed by opening the URL of the file in the /uploads/ directory. This module has been successfully tested on CMS Made Simple versions 2.2.5 and 2.2.7. Module...

Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", 'Description' = %q This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter...

Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow

This module exploits a stack based buffer overflow in Delta Electronics Delta Industrial Automation COMMGR 1.08. The vulnerability exists in COMMGR.exe when handling specially crafted packets. This module has been tested successfully on Delta Electronics Delta Industrial Automation COMMGR 1.08 ov...

Boxoft WAV To MP3 Converter 1.1 Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow", 'Description' = %q This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter...

FTPShell Client 6.70 Enterprise Edition Stack Buffer Overflow Exploit

This Metasploit module exploits a buffer overflow in the FTPShell client 6.70 Enterprise edition allowing remote code execution. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTPShell client...

FTPShell Client 6.70 Enterprise Edition Stack Buffer Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTPShell client 6.70 Enterprise edition Stack Buffer Overflow', 'Description' = %q This module exploits a buffer overflow in the FTPShell client...

FreeBSD 7.3 to 9.0-RC1 privilege escalation/denial of service

Buffer overflow in the 'Linux emulation' support in FreeBSD kernel allows local users to cause a denial of service panic and possibly execute arbitrary code by calling the bind system call with a long path for a UNIX-domain socket, which is not properly handled when the address is used by other...

WebKitGTK+ WebKitFaviconDatabase Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "WebKitGTK+ WebKitFaviconDatabase DoS", 'Description' = %q This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If...

WebKitGTK+ < 2.21.3 - #WebKitFaviconDatabase DoS Exploit

Exploit for linux platform in category dos / poc Title: WebKitGTK+ "WebKitGTK+ WebKitFaviconDatabase DoS", 'Description' = %q This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful, it could lead to application crash, resulting in denial of service. ,...

Splunk __raw Server Info Disclosure

Splunk 6.2.3 through 7.0.1 allows information disclosure by appending /raw/services/server/info/server-info?outputmode=json to a query. Versisons 6.6.0 through 7.0.1 require authentication. Module Options msf use auxiliary/gather/splunk/rawserverinfo msf undefinedrawserverinfo show actions...

Cisco ASA Directory Traversal

This module exploits a directory traversal vulnerability in Cisco's Adaptive Security Appliance ASA software and Firepower Threat Defense FTD software. It lists the contents of Cisco's VPN web service which includes directories, files, and currently logged in users. Module Options msf use...

WebKitGTK+ WebKitFaviconDatabase DoS

This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful, it could lead to application crash, resulting in denial of service. Module Options msf use auxiliary/dos/http/webkitplus msf undefinedwebkitplus show actions ...actions... msf undefinedwebkitplus s...

Dolibarr Gather Credentials via SQL Injection

This module enables an authenticated user to collect the usernames and encrypted passwords of other users in the Dolibarr ERP/CRM via SQL injection. Module Options msf use auxiliary/gather/dolibarr/credssqli msf undefinedcredssqli show actions ...actions... msf undefinedcredssqli set ACTION msf...