IBM Notes encodeURI DOS

This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If successful, it could cause the Notes client to hang and have to be restarted. Module Options msf use auxiliary/dos/http/ibm/lotusnotes msf undefinedlotusnotes show actions ...actions... msf...

Open WAN-to-LAN proxy on AT&T routers

The Arris NVG589 and NVG599 routers configured with AT&T U-verse firmware 9.2.2h0d83 expose an un-authenticated proxy that allows connecting from WAN to LAN by MAC address. Module Options msf use auxiliary/scanner/wproxy/att/openproxy msf undefinedopenproxy show actions ...actions... msf...

Git < 2.7.5 - Command Injection (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Malicious Git HTTP Server For CVE-2017-1000117', 'Description' = %q This module exploits CVE-2017-1000117, which affects Git version 2.7.5 and...

Metasploit Cross Site Request Forgery Vulnerability - Windows

Metasploit is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Metasploit 4.14.1-20170828 - Cross-Site Request Forgery

Metasploit 4.14.1-20170828 - Cross-Site Request Forgery Exploit Title: CSRF Date: Wed, Aug 30, 2017 Software Link: https://www.metasploit.com/ Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-15084 R7-2017-22 Category:...

Metasploit Detection (Linux/Unix SSH Login)

Detects the installed version of Metasploit on Linux. The script logs in via ssh, searches for executable and queries the version from SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Metasploit Web UI < 4.14.1-20170828 - Cross-Site Request Forgery

Exploit Title: CSRF Date: Wed, Aug 30, 2017 Software Link: https://www.metasploit.com/ Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-15084 R7-2017-22 Category: Metasploit Pro, Express, Ultimate, and Community 1...

Metasploit Cross Site Request Forgery Vulnerability - Linux

Metasploit is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

QNAP Transcode Server Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'QNAP Transcode Server Command Execution', 'Description' = %q This module exploits an unauthenticated remote command injection vulnerability in QN...

QNAP Transcode Server Command Execution Exploit

This Metasploit module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the 'rmfile' command. This Metasploit module was tested successfully on a QNAP TS-431...

Dup Scout Enterprise 9.9.14 - Remote Buffer Overflow (SEH)

!/usr/bin/env python Exploit Title: Dup Scout Enterprise v 9.9.14 Date: 2017-08-25 Exploit Author: Nipun Jaswal & Anurag Srivastava Author Homepage: www.pyramidcyber.com Vendor Homepage: http://www.dupscout.com Software Link: http://www.dupscout.com/setups/dupscoutentsetupv9.9.14.exe Version:...

Fedora 26 : kernel (2017-4336d64e21)

The 4.12.8 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

FreeBSD : evince and atril -- command injection vulnerability in CBT handler (01a197ca-67f1-11e7-a266-28924a333806)

GNOME reports : The comic book backend in evince 3.24.0 and earlier is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened. The same vulnerability affects atril, the Evince fork. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution Exploit

This Metasploit module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage'...

IBM OpenAdmin Tool - SOAP welcomeServer PHP Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution', 'Description' = %q This module exploits an unauthenticated remote PHP code execution...

Windows Escalate UAC Protection Bypass (Via COM Handler Hijack) Exploit

This Metasploit module will bypass Windows UAC by creating COM handler registry entries in the HKCU hive. When certain high integrity processes are loaded, these registry entries are referenced resulting in the process loading user-controlled DLLs. These DLLs contain the payloads that result in...

Microsoft Windows - Escalate UAC Protection Bypass (Via COM Handler Hijack) (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/exe' class MetasploitModule 'Windows Escalate UAC Protection Bypass Via COM Handler Hijack', 'Description' = %q This module will bypass Windows...

VMware VDP Known SSH Key Exploit

VMware vSphere Data Protection appliances 5.5.x through 6.1.x contain a known ssh private key for the local user admin who is a sudoer without password. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh'...

Scientific Linux Security Update : git on SL7.x x86_64 (20170817)

Security Fixes : - A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Git. An attacker could use this flaw to execute shell commands with the privileges of the user running the Git client, for example, when performing a 'clone' action on a malicious...

Hack with Metasploit: Announcing the UNITED 2017 CTF

Got mad skillz? Want mad skillz? This year at Rapid7s annual UNITED Summit, were hosting a first-of-its-kind Capture the Flag CTF competition. Whether youre a noob to hacking or a grizzled pro, youll emerge from our 25-hour CTF with more knowledge and serious bragging rights. Show off your 1337...