Linux Execute Command

A very small shellcode for executing commands. This module is sometimes helpful for testing purposes as well as on targets with extremely limited buffer space. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source:...

FreePBX - 'config.php' Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "FreePBX config.php Remote Code Execution", 'Description' = %q This module exploits a vulnerability found in FreePBX version 2.9, 2.10...

FreePBX config.php Remote Code Execution Vulnerability

This Metasploit module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11. It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php" parameters "function" and "args". This module requires Metasploit: http//metasploit.com/download Current source:...

LifeSize UVC Authenticated Remote Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "LifeSize UVC Authenticated RCE via Ping", 'Description' = %q When authenticated as an administrator on LifeSize UVC 1.2.6, an attacke...

LifeSize UVC Authenticated Remote Command Execution

When authenticated as an administrator on LifeSize UVC 1.2.6, an attacker can abuse the ping diagnostic functionality to achieve remote command execution as the www-data user or equivalent. This module requires Metasploit: http//metasploit.com/download Current source:...

Horde Framework Unserialize PHP Code Execution

This Metasploit module exploits a php unserialize vulnerability in Horde versions 5.1.1 and below which could be abused to allow unauthenticated users to execute arbitrary code with the permissions of the web server. The dangerous unserialize exists in the 'lib/Horde/Variables.php' file. The...

Horde Framework - Unserialize PHP Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Horde Framework Unserialize PHP Code Execution', 'Description' = %q This module exploits a php unserialize vulnerability in Horde...

Array Networks vAPV and vxAG - Private Key Privilege Escalation / Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 "Array Networks vAPV and vxAG Private Key Privelege Escalation Code Execution", 'Description' = %q This module...

FreePBX config.php Remote Code Execution

This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11. It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php" parameters "function" and "args". Module Options msf use exploit/unix/webapp/freepbx/configexec msf undefinedconfigexec show...

Linux Reboot

A very small shellcode for rebooting the system. This payload is sometimes helpful for testing purposes or executing other payloads that rely on initial startup procedures. This module requires Metasploit: https://metasploit.com/download Current source:...

MS14-012 Internet Explorer TextRange Use-After-Free

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS14-012 Internet Explorer TextRange Use-After-Free", 'Description' = %q This module exploits a use-after-free vulnerability found in...

Quantum DXi V1000 SSH Private Key Exposure

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 'Quantum DXi V1000 SSH Private Key Exposure', 'Description' = %q Quantum ships a public/private key pair on DXi V100...

SePortal SQLi Remote Code Execution

This module exploits a vulnerability found in SePortal version 2.5. When logging in as any non-admin user, it's possible to retrieve the admin session from the database through SQL injection. The SQL injection vulnerability exists in the "staticpages.php" page. This hash can be used to take over...

Quantum vmPRO - Backdoor Command Exploit

Quantum ships a public/private key pair on DXi V1000 2.2.1 appliances that allows passwordless authentication to any other DXi box. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. require 'msf/core' require 'net/ssh' class Metasploit3 "Quant...

Quantum vmPRO Backdoor Command

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 "Quantum vmPRO Backdoor Command", 'Description' = %q This module abuses a backdoor command in vmPRO 3.1.2. Any user,...

Quantum vmPRO - Backdoor Command (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'net/ssh' class Metasploit3 "Quantum vmPRO Backdoor Command", 'Description' = %q This module abuses a backdoor command in vmPRO 3.1.2. Any user,...

Firefox WebIDL Privileged Javascript Injection

This exploit gains remote code execution on Firefox 22-27 by abusing two separate privilege escalation vulnerabilities in Firefox's Javascript APIs. Module Options msf use exploit/multi/browser/firefox/webidlinjection msf undefinedwebidlinjection show actions ...actions... msf...

Quantum DXi V1000 SSH Private Key Exposure

Quantum ships a public/private key pair on DXi V1000 2.2.1 appliances that allows passwordless authentication to any other DXi box. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. Module Options msf use...

Quantum vmPRO Backdoor Command

This module abuses a backdoor command in Quantum vmPRO. Any user, even one without admin privileges, can get access to the restricted SSH shell. By using the hidden backdoor "shell-escape" command it's possible to drop to a real root bash shell. This module has been tested successfully on Quantum...

Loadbalancer.org Enterprise VA SSH Private Key Exposure

Loadbalancer.org ships a public/private key pair on Enterprise virtual appliances version 7.5.2 that allows passwordless authentication to any other LB Enterprise box. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. Module Options msf use...