Watchguard XCS FixCorruptMail Local Privilege Escalation

This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called by root's crontab which can be exploited to run a command as root within 3 minutes. Module Options msf use exploit/freebsd/local/watchguard/fixcorruptmail msf undefinedfixcorruptmail show actions ...actions...

Endian Firewall 3.0.0 - OS Command Injection (Metasploit)

Endian Firewall 3.0.0 - OS Command Injection Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall %q This module exploits an OS command injection vulnerabilit...

Pallete Projects Werkzeug Debugger Remote Code Execution

This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django. It may also be used alone. The documentation states the following...

Adobe Flash Player Drawing Fill Shader Memory Corruption

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe Flash Player Drawing Fill Shader Memory Corruption', 'Description' = %q This module exploits a memory corruption happening whe...

Adobe Flash Player - ShaderJob Buffer Overflow (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe Flash Player ShaderJob Buffer Overflow', 'Description' = %q This module exploits a buffer overflow vulnerability related to th...

Windows Gather Credentials Local Administrator Password Solution

This module will recover the LAPS Local Administrator Password Solution passwords, configured in Active Directory, which is usually only accessible by privileged users. Note that the local administrator account name is not stored in Active Directory, so it is assumed to be 'Administrator' by...

Microsoft Windows ClientCopyImage Improper Object Handling Exploit

This Metasploit module exploits improper object handling in the win32k.sys kernel mode driver. This Metasploit module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64. This module requires Metasploit: http://metasploit.com/download Current source:...

KMPlayer 3.9.1.136 - Capture Unicode Buffer Overflow (ASLR Bypass)

!/usr/bin/python KMPlayer 3.9.1.136 Capture Unicode Buffer Overflow ASLR Bypass Author: Naser Farhadi Date: 21 June 2015 Version: 3.9.1.136 Tested on: Windows 7 SP1 32 bit Usage: chmod +x KMPlayer.py python KMPlayer.py Alt+c | Video Capture | Alt+a | Audio Capture paste content of KMPlayer.txt in...

Microsoft Windows ClientCopyImage Improper Object Handling

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows ClientCopyImage Win32k Exploit', 'Description' = %q Thi...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)

Ruby on Rails blog : Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

Wordpress Front-end Editor File Upload Exploit

The Wordpress Front-end Editor plugin contains an authenticated file upload vulnerability. We can upload arbitrary files to the upload folder, because the plugin also uses it's own file upload mechanism instead of the wordpress api it's possible to upload any file type. This module requires...

Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution

This module exploits an IP whitelist bypass vulnerability in the developer web console included with Ruby on Rails 4.0.x and 4.1.x. This module will also achieve code execution on Rails 4.2.x if the attack is launched from a whitelisted IP range. Module Options msf use...

Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Ruby on Rails Web Console v2 Whitelist Bypass Code Execution', 'Description' = %q This module exploits an IP whitelist bypass...

Overlayfs Privilege Escalation

This module attempts to exploit two different CVEs related to overlayfs. CVE-2015-1328: Ubuntu specific - 3.13.0-24 14.04 default use exploit/linux/local/overlayfs/privesc msf undefinedprivesc show actions ...actions... msf undefinedprivesc set ACTION msf undefinedprivesc show options ...show and...

openSUSE Security Update : proftpd (openSUSE-2015-410)

The ftp server ProFTPD was updated to 1.3.5a to fix one security issue. The following vulnerability was fixed : - CVE-2015-3306: Unauthenticated copying of files via SITE CPFR/CPTO allowed by modcopy boo927290 In addition, proftpd was updated to 1.3.5a to fix a number of upstream bugs and improve...

D-Link Cookie Command Execution

This module exploits an anonymous remote upload and code execution vulnerability on different D-Link devices. The vulnerability is a command injection in the cookie handling process of the lighttpd web server when handling specially crafted cookie values. This module has been successfully tested ...

ProFTPD 1.3.5 Mod_Copy Command Execution Exploit

This Metasploit module exploits the SITE CPFR/CPTO commands in ProFTPD version 1.3.5. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. The copy commands are executed with the rights of the ProFTPD service, which by defau...

ProFTPd 1.3.5 - 'mod_copy' Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'ProFTPD 1.3.5 ModCopy Command Execution', 'Description' = %q This module exploits the SITE CPFR/CPTO commands in ProFTPD version...

GitHub accounts hacked: old vulnerability leads to a weak key a large number of retention-vulnerability and early warning-the black bar safety net

See also history of the causes of security risks Seven years ago the developer found the GitHub there is a catastrophic vulnerability after GitHub has closed a number of unidentified by key to access the account. Github allows authorized users to login to affiliated with Spotify, Yandex, and the ...