Zimbra zmslapd arbitrary module load

This module exploits CVE-2022-37393, which is a vulnerability in Zimbra's sudo configuration that permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes...

Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated remote code execution vulnerability which exists in Apache version 2.4.49 CVE-2021-41773. If files outside of the document root are not protected by ‘require all denied’ and CGI has been explicitly enabled, it can be used to execute arbitrary...

Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache 2.4.49/2.4.50 Traversal RCE', 'Description' = %q This module exploit an unauthenticated RCE vulnerability which exists in Apache version...

Exploit for Path Traversal in Vmware Cloud_Foundation

CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about...

Metasploit Wrap-Up

We just couldn't contain ourselves! This week we've got two Kubernetes modules coming at you from adfoster-r7 and smcintyre-r7. First up is an enum module auxiliary/cloud/kubernetes/enumkubernetes that'll extract a variety of information including the namespaces, pods, secrets, service token...

TA551 Shifts Tactics to Install Sliver Red-Teaming Tool

The criminal threat group known as TA551 has added the Sliver red-teaming tool to its bag of tracks – a move that may signal ramped up ransomware attacks ahead, researchers said. According to Proofpoint researchers, TA551 aka Shathak has been mounting cyberattacks that start with email thread...

Exploit for Deserialization of Untrusted Data in Veeam One

Modified-CVE-2020-10915-MsfModule THIS IS NOT AN ORIGINAL EXPL...

Fresh APT Harvester Reaps Telco, Government Data

A previously unseen advanced persistent threat APT group dubbed Harvester by researchers is attacking telcos, IT companies and government-sector targets in a campaign that’s been ongoing since June. According to a Symantec analysis, the group sports a veritable cornucopia of advanced and custom...

Metasploit Wrap-Up

An Especially Spooky Season for Moodle This release has not one, two, or three, but FOUR authenticated Moodle exploit modules, or should I say moodules? H00die comes through again with not just modules, but also an artisanal, bespoke library to support further work. Two target the spell check...

Moodle Admin Shell Upload Exploit

This Metasploit module will generate a plugin which can receive a malicious payload request and upload it to a server running Moodle provided valid admin credentials are used. Then the payload is sent for execution, and the plugin uninstalled. You must have an admin account to exploit this...

Moodle Authenticated Spelling Binary Remote Code Execution Exploit

Moodle allows an authenticated user to define spellcheck settings via the web interface. The user can update the spellcheck mechanism to point to a system-installed aspell binary. By updating the path for the spellchecker to an arbitrary command, an attacker can run arbitrary commands in the...

Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution Exploit

Moodle versions 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12, and earlier unsupported versions allow for a teacher to exploit chain to remote code execution. A bug in the privileges system allows a teacher to add themselves as a manager to their own class. They can then add any other users, and...

Moodle SpellChecker Path Authenticated Remote Command Execution Exploit

Moodle allows an authenticated administrator to define spellcheck settings via the web interface. An administrator can update the aspell path to include a command injection. This is extremely similar to CVE-2013-3630, just using a different variable. This Metasploit module was tested against Mood...

KB5006715: Windows Server 2008 Security Update (October 2021)

The remote Windows host is missing security update 5006715. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

Moodle Admin Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Moodle Admin Shell Upload', 'Description' = %q This module will generate a plugin which can receive a malicious payload request and upload it to ...

KB5006674: Windows 11 Security Update (October 2021)

The remote Windows host is missing security update 5006674. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

KB5006699: Windows Server 2022 Security Update (October 2021)

The remote Windows host is missing security update 5006699. It is, therefore, affected by multiple vulnerabilities %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself is...

KB5006732: Windows Server 2012 Security Update (October 2021)

The remote Windows host is missing security update 5006732. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Microsoft Security Updates API. The text itself i...

WordPress Plugin Pie Register Auth Bypass to RCE

This module uses an authentication bypass vulnerability in Wordpress Plugin Pie Register use exploit/unix/webapp/wp/pieregisterbypassrce msf undefinedpieregisterbypassrce show actions ...actions... msf undefinedpieregisterbypassrce set ACTION msf undefinedpieregisterbypassrce show options ...show...

Netfilter x_tables Heap Out-Of-Bounds Write / Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netfilter xtables Heap OOB Write Privilege Escalation', 'Description' = %q A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was...