MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free

This Metasploit module exploits an use after free condition on Internet Explorer as used in the wild on the "Operation SnowMan" in February 2014. The module uses Flash Player 12 in order to bypass ASLR and finally DEP. This module requires Metasploit: http//metasploit.com/download Current source:...

Microsoft Internet Explorer - CMarkup Use-After-Free (MS14-012) (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free", 'Description' = %q This module exploits an use after free condition on...

Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution (Metasploit)

Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution Metasploit Unitrends Enterprise Backup 7.3.0 Multiple vulnerabilities exist within this piece of software. The largest one is likely the fact that the ‘auth’ string used for authorization isn’t random at all. After authentication, any...

Unitrends Enterprise Backup 7.3.0 - Root Remote Code Execution (Metasploit)

Unitrends Enterprise Backup 7.3.0 Multiple vulnerabilities exist within this piece of software. The largest one is likely the fact that the ‘auth’ string used for authorization isn’t random at all. After authentication, any requests made by the browser send no cookies and only check this ‘auth’...

Unitrends Unauthenticated Root Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Unitrends Unauthenticated Root RCE", 'Description' = %q , 'License' = MSFLICENSE, 'Author' = 'Brandon Perry ' discovery/metasploit...

Kvasir - Penetration Testing Data Management Tool

Penetration Testing Data Management can be a nightmware, because well you generate a LOT of data and some information when conducing a penetration test, especially using tools – they return lots of actual and potential vulnerabilitites to review. Port scanners can return thousands of ports for ju...

PhpMyAdmin exploits concludes With Metasploit-vulnerability warning-the black bar safety net

A: affects versions: 3.5. x 3.5.8.1 and 4.0.0 4.0.0-rc3 Overview: PhpMyAdmin presence of a PREGREPLACEEVAL vulnerability Use module: exploit/multi/http/phpmyadminpregreplace CVE: CVE-2 0 1 3-3 2 3 8 II: effects version: phpMyAdmin v3. 5. 2. 2 Overview: PhpMyAdmin存在serversync.php Backdoor...

Adobe Reader for Android addJavascriptInterface Exploit

Adobe Reader versions less than 11.2.0 exposes insecure native interfaces to untrusted javascript in a PDF. This module embeds the browser exploit from android/webviewaddjavascriptinterface into a PDF to get a command shell on vulnerable versions of Reader. Module Options msf use...

Firefox Gather Passwords from Privileged JavaScript Shell

This module allows collection of passwords from a Firefox Privileged JavaScript Shell. Module Options msf use post/firefox/gather/passwords msf undefinedpasswords show actions ...actions... msf undefinedpasswords set ACTION msf undefinedpasswords show options ...show and set options... msf...

Mac OS X NFS Mount Privilege Escalation Exploit

This exploit leverages a stack buffer overflow vulnerability to escalate privileges. The vulnerable function nfsconvertoldnfsargs does not verify the size of a user-provided argument before copying it to the stack. As a result, by passing a large size as an argument, a local user can overwrite th...

eScan Web Management Console Command Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "eScan Web Management Console Command Injection", 'Description' = %q This module exploits a command injection vulnerability found in t...

Collection of Heartbleed Tools (OpenSSL CVE-2014-0160)

A checker site and tool for CVE-2014-0160: https://github.com/FiloSottile/Heartbleed ssltest.py : Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford http://pastebin.com/WmxzjkXJ SSL Server Test https://www.ssllabs.com/ssltest/index.html Metasploit...

Sophos Web Protection Appliance Command Execution Exploit

This Metasploit module takes advantage of two vulnerabilities in order to gain remote code execution as root as an otherwise non-privileged authorized user. By taking advantage of a mass assignment vulnerability that allows an unprivileged authenticated user to change the administrator's password...

Sophos Web Protection Appliance Interface - (Authenticated) Arbitrary Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution', 'Description' = %q This module takes advantage ...

OpenSSL Heartbeat (Heartbleed) Information Leak Exploit

This Metasploit module implements the OpenSSL Heartbleed attack. The problem exists in the handling of heartbeat requests, where a fake length can be used to leak memory data in the response. Services that support STARTTLS may also be vulnerable. This module requires Metasploit:...

Exploit for Out-of-bounds Read in Openssl

HeartBleed Tester & Exploit --------------------------- NB Ne...

Difficulty of Detecting OpenSSL Heartbleed Attacks Adds to Problem

The list of products and sites affected by the OpenSSL heartbleed vulnerability continues to grow, and as security teams implement the patch and dig into the thornier work of revoking certificates, a new problem is emerging: It’s difficult to know whether an attacker has exploited the vulnerabili...

Cisco ASA SSL VPN Privilege Escalation Vulnerability

This module exploits a privilege escalation vulnerability for Cisco ASA SSL VPN aka: WebVPN. It allows level 0 users to escalate to level 15. Module Options msf use auxiliary/scanner/http/cisco/sslvpnprivesc msf undefinedsslvpnprivesc show actions ...actions... msf undefinedsslvpnprivesc set ACTI...

Vtiger Install Unauthenticated Remote Command Execution Exploit

This Metasploit module exploits an arbitrary command execution vulnerability in the Vtiger install script. This Metasploit module is set to ManualRanking due to this module overwriting the target database configuration, which may result in a broken web app, and you may not be able to get a sessio...

Fedora 20 : openssl-1.0.1e-37.fc20.1 (2014-4879)

pull in upstream patch for CVE-2014-0160 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory 2014-4879. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid73429;...