Safari User-Assisted Applescript Exec Attack Exploit

Exploit for macOS platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Safari User-Assisted Applescript Exec Attack', 'Description' = %q In versions...

[ZDI-15-396] ManageEngine ServiceDesk Plus remote code execution

Hi, Yet another RCE bug in ManageEngine ServiceDesk. This was disclosed by ZDI under ID ZDI-15-396 on August 20th, and fixed in version 9103 1. Details below, full advisory can be obtained from my repo at E2. A Metasploit module that exploits this vulnerability has been submitted upstream in E3...

Safari User-Assisted Applescript Exec Attack

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Safari User-Assisted Applescript Exec Attack', 'Description' = %q In versions of Mac OS X before 10.11.1, the applescript:// URL...

Joomla com_contenthistory Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/contenthistorysqli msf undefinedcontenthistorysqli show actions ...actions... msf...

OpenVPN Gather Credentials

This module grab OpenVPN credentials from a running process in Linux. Note: --auth-nocache must not be set in the OpenVPN command line. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenVPN...

Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

Tomabo MP4 Player 3.11.6 - SEH Based Stack Overflow

Exploit for windows platform in category local exploits !/usr/bin/python Exploit Title: Tomabo MP4 Player 3.11.6 SEH Based Stack Overflow Exploit Author: @yokoacc, @nudragn, @runggareksya Vendor Homepage: http://www.tomabo.com/ Software Link: http://www.tomabo.com/mp4-player/download.html...

Nibbleblog File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

Safari User-Assisted Applescript Exec Attack

In versions of Mac OS X before 10.11.1, the applescript:// URL scheme is provided, which opens the provided script in the Applescript Editor. Pressing cmd-R in the Editor executes the code without any additional confirmation from the user. By getting the user to press cmd-R in Safari, and by...

X11 Keyboard Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "\x0a", '2' = "\x0b", '3' = "\x0c", '4' = "\x0d", '5' = "\x0e", '6' = "\x0f", '7' = "\x10", '&' = "\x10", '8' = "\x11", '9' = "\x12",...

ElasticSearch Snapshot API Directory Traversal

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'json' class Metasploit3 'ElasticSearch Snapshot API Directory Traversal', 'Description' = %q This module exploits a directory traversal...

ElasticSearch Snapshot API Directory Traversal

'This module exploits a directory traversal vulnerability in ElasticSearch, allowing an attacker to read arbitrary files with JVM process privileges, through the Snapshot API.' This module requires Metasploit: https://metasploit.com/download Current source:...

Limesurvey Unauthenticated File Download

This module exploits an unauthenticated file download vulnerability in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded as a ZIP and unzipped automatically, thus binary files can be downloaded. Module Options msf use auxiliary/admin/http/limesurvey/filedownload msf...

Wordpress Ajax Load More PHP Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress Ajax Load More version 2.8.1.1. It allows to upload arbitrary php files and get remote code execution. This module has been tested successfully on WordPress Ajax Load More 2.8.0 with Wordpress 4.1.3 on Ubuntu 12.04/14.04 Server. Modul...

HP SiteScope DNS Tool Command Injection

This module exploits a command injection vulnerability discovered in HP SiteScope 11.30 and earlier versions tested in 11.26 and 11.30. The vulnerability exists in the DNS Tool allowing an attacker to execute arbitrary commands in the context of the service. By default, HP SiteScope installs and...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ManageEngine ServiceDesk Plus Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerability in...

Watermark Master Buffer Overflow (SEH) Exploit

This Metasploit module exploits a stack based buffer overflow in Watermark Master 2.2.23 when processing a specially crafted .WCF file. This vulnerability could be exploited by a remote attacker to execute arbitrary code on the target machine by enticing a user of Watermark Master to open a...

Watermark Master Buffer Overflow (SEH)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Watermark Master Buffer Overflow SEH', 'Description' = %q This module exploits a stack based buffer overflow in Watermark Master...

ManageEngine ServiceDesk Plus Arbitrary File Upload Exploit

This Metasploit module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This Metasploit module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The...

HTTP Host Header Injection Detection

Checks if the host is vulnerable to Host header injection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Host Header Injection Detection', 'Description' = 'Checks if the host is vulnerabl...