KiTTY Portable 0.65.0.2p - Chat Remote Buffer Overflow (SEH Windows XP/7/10)

Exploit for windows platform in category remote exploits Exploit Title: KiTTY Portable = 0.65.0.2p Chat Remote Buffer Overflow SEH WinXP/Win7/Win10 Date: 28/12/2015 Exploit Author: Guillaume Kaddouch Twitter: @gkweb76 Blog: http://networkfilter.blogspot.com GitHub:...

AD Computer, Group and Recursive User Membership to Local SQLite DB

This module will gather a list of AD groups, identify the users taking into account recursion and write this to a SQLite database for offline analysis and query using normal SQL syntax. This module requires Metasploit: https://metasploit.com/download Current source:...

Dynamic Shellcode Injection: Shellter

Shellter is a dynamic shellcode injection tool, and probably the first dynamic PE infector ever created. It can be used in order to inject shellcode into native Windows applications currently 32-bit apps only. The shellcode can be something yours or something generated through a framework, such a...

Generate CSV Organizational Chart Data Using Manager Information

This module will generate a CSV file containing all users and their managers, which can be imported into Visio which will render it. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Generate CSV...

Juniper SSH Backdoor Scanner

This module scans for the Juniper SSH backdoor also valid on Telnet. Any username is required, and the password is use auxiliary/scanner/ssh/juniper/backdoor msf undefinedbackdoor show actions ...actions... msf undefinedbackdoor set ACTION msf undefinedbackdoor show options ...show and set...

TP-Link SC2020n Authenticated Telnet Injection

The TP-Link SC2020n Network Video Camera is vulnerable to OS Command Injection via the web interface. By firing up the telnet daemon, it is possible to gain root on the device. The vulnerability exists at /cgi-bin/admin/servetest, which is accessible with credentials. Module Options msf use...

blueman set_dhcp_handler D-Bus Privilege Escalation

This module attempts to gain root privileges by exploiting a Python code injection vulnerability in blueman versions prior to 2.0.3. The org.blueman.Mechanism.EnableNetwork D-Bus interface exposes the setdhcphandler function which uses user input in a call to eval, without sanitization, resulting...

Telisca IPS Lock Cisco IP Phone Control

This module allows an unauthenticated attacker to exercise the "Lock" and "Unlock" functionality of Telisca IPS Lock for Cisco IP Phones. This module should be run in the VoIP VLAN, and requires knowledge of the target phone's name for example, SEP002497AB1D4B. Set ACTION to either LOCK or UNLOCK...

Metasploit Meterpreter Reverse Payloads Remote Code Execution

A reverse shell is a type of shell in which the target machine communicates back to the attacking machine on a listener port. By remotely installing and running such a shell on the target machine, the attacker achieves remote code or command execution abilities, or may obtain sensitive informatio...

Joomla HTTP Header Unauthenticated Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Joomla HTTP Header Unauthenticated Remote Code Execution', 'Description' = %q Joomla suffers from an unauthenticated remote code...

Post Windows Gather NTDS.DIT Location

This module will find the location of the NTDS.DIT file from the Registry, check that it exists, and display its location on the screen, which is useful if you wish to manually acquire the file using ntdsutil or vss. This module requires Metasploit: https://metasploit.com/download Current source:...

IBM Tivoli Storage Manager FastBack Server Opcode 0x534 Denial of Service

This module exploits a denial of service condition present in IBM Tivoli Storage Manager FastBack Server when dealing with packets triggering the opcode 0x534 handler. Module Options msf use auxiliary/dos/misc/ibm/tsmdos msf undefinedtsmdos show actions ...actions... msf undefinedtsmdos set ACTIO...

ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Exploit

This Metasploit module exploits a vulnerability found in ManageEngine Desktop Central 9. When uploading a 7z file, the FileUploadServlet class does not check the user-controlled ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to inject a null bye at the end of...

http-vuln-cve2014-3704 NSE Script

Exploits CVE-2014-3704 also known as 'Drupageddon' in Drupal. Versions 7.32 of Drupal core are known to be affected. Vulnerability allows remote attackers to conduct SQL injection attacks via an array containing crafted keys. The script injects new Drupal administrator user via login form and the...

Jenkins CLI RMI Java Deserialization

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Jenkins CLI RMI Java Deserialization Vulnerability', 'Description' = %q This module exploits a vulnerability in Jenkins. An unsafe...

Siemens Simatic S7 1200 - CPU Command Module (Metasploit)

Exploit Title: Simatic S7 1200 CPU command module Date: 15-12-2015 Exploit Author: Nguyen Manh Hung Vendor Homepage: http://www.siemens.com/ Tested on: Siemens Simatic S7-1214C CVE : None require 'msf/core' class Metasploit3 'Simatic S7-1200 CPU START/STOP Module', 'Description' = %q Update 2015...

Legend Perl IRC Bot - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Legend Perl IRC Bot Remote Code Execution', 'Description' = %q This module exploits a remote command execution on the Legend Perl IR...

Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution Exploit

This Metasploit module allows remote command execution on an IRC Bot developed by xdh. This perl bot was caught by Conor Patrick with his shellshock honeypot server and is categorized by Markus Zanke as an fBot Fire & Forget - DDoS Bot. Matt Thayer also found this script which has a description o...

Legend Perl IRC Bot Remote Code Execution Exploit

This Metasploit module exploits a remote command execution on the Legend Perl IRC Bot . This bot has been used as a payload in the Shellshock spam last October 2014. This particular bot has functionalities like NMAP scanning, TCP, HTTP, SQL, and UDP flooding, the ability to remove system logs, an...

Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution', 'Description' = %q This module allows remote command execution on an I...