Linux Command Shell, Bind TCP Random Port Inline

Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: 'nmap -sS target -p-'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 57...

freeFTPd 1.0.10 (PASS Command) - SEH Buffer Overflow Vulnerability

Exploit for windows platform in category remote exploits !/usr/bin/perl freeFTPd 1.0.10 anonymous-auth PASS SEH buffer overflow PoC by Wireghoul - www.justanotherhacker.com Date: 20130820 Tested on: XPSP3 Similar exploits: EDB 23079 1330 1339 Greetz corelan, TecR0C, mrme, jjkakakk if scalar@ARGV ...

Java - 'storeImageArray()' Invalid Array Indexing (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class Metasploit3 false def initialize inf...

Java storeImageArray() Invalid Array Indexing Vulnerability

This Metasploit module abuses an Invalid Array Indexing Vulnerability on the static function storeImageArray function in order to produce a memory corruption and finally escape the Java Sandbox. The vulnerability affects Java version 7u21 and earlier. The module, which doesn't bypass click2play,...

Ultra Mini HTTPd - Remote Stack Buffer Overflow (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Ultra Mini HTTPD...

Intrasrv 1.0 Buffer Overflow

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Intrasrv 1.0 Buff...

Java storeImageArray() Invalid Array Indexing Vulnerability

This module abuses an Invalid Array Indexing Vulnerability on the static function storeImageArray function in order to cause a memory corruption and escape the Java Sandbox. The vulnerability affects Java version 7u21 and earlier. The module, which doesn't bypass click2play, has been tested...

XnView 2.x < 2.04 Multiple Buffer Overflow Vulnerabilities

The version of XnView installed on the remote Windows host is 2.x, earlier than 2.04. It is, therefore, reportedly affected by the following overflow vulnerabilities: - An unspecified error exists that could allow a buffer overflow during 'PCT' file handling. CVE-2013-2577 - Unspecified errors...

Apache Rave User Information Disclosure

This module exploits an information disclosure in Apache Rave 0.20 and prior. The vulnerability exists in the RPC API, which allows any authenticated user to disclose information about all the users, including their password hashes. In order to authenticate, the user can provide his own...

Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation

Exploit for windows platform in category local exploits require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require 'msf/core/post/windows/process' class Metasploit3 'Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation', 'Description' = %q...

ABBS Audio Media Player .LST Buffer Overflow

This module exploits a buffer overflow in ABBS Audio Media Player. The vulnerability occurs when adding a specially crafted .lst file, allowing arbitrary code execution with the privileges of the user running the application. This module has been tested successfully on ABBS Audio Media Player 3.1...

PCMAN FTP Server Post-Authentication STOR Command Stack Buffer Overflow

This module exploits a buffer overflow vulnerability found in the STOR command of the PCMAN FTP v2.07 Server when the "/../" parameters are also sent to the server. Please note authentication is required in order to trigger the vulnerability. The overflowing string will also be seen on the FTP...

FreeBSD 9 - Address Space Manipulation Privilege Escalation (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4 'FreeBSD 9 Address Space Manipulation...

FreeBSD 9 Address Space Manipulation Privilege Escalation

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit4 'FreeBSD 9 Address Space Manipulation...

FreeBSD 9 Address Space Manipulation Privilege Escalation

This Metasploit module exploits a vulnerability that can be used to modify portions of a process's address space, which may lead to privilege escalation. Systems such as FreeBSD 9.0 and 9.1 are known to be vulnerable. This file is part of the Metasploit Framework and may be subject to...

LibrettoCMS File Manager Arbitrary File Upload

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "LibrettoCMS File...

Havalite CMS Arbitary File Upload Exploit

This Metasploit module exploits a file upload vulnerability found in Havalite CMS version 1.1.7. Prior versions are possibly affected. Attackers can abuse the upload feature in order to upload a malicious PHP file without authentication, which results in arbitrary remote code execution. This file...

Havalite CMS Arbitary File Upload

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Havalite CMS...

MoinMoin twikidraw Action Traversal File Upload

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'MoinMoin twikidraw Action Traversal...

MoinMoin twikidraw Action Traversal File Upload Vulnerability

This Metasploit module exploits a vulnerability in MoinMoin 1.9.5. The vulnerability exists on the manage of the twikidraw actions, where a traversal path can be used in order to upload arbitrary files. Exploitation is achieved on Apached/modwsgi configurations by overwriting moin.wsgi, which...