RAWR – Rapid Assessment of Web Resources

RAWR is designed to make the process of web enumeration easy and efficient by providing pertinent information in usable formats. It uses NMaplive or from file, Metasploit, Qualys, Nexpose, or Nessus scan data to target web services for enumeration, then visits each host on each port with an...

Windows tcpip.sys Arbitrary Write Privilege Escalation Exploit

A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys, can allow an attacker to inject controlled memory into an arbitrary location within the kernel. This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Windows tcpip.sys Arbitrary Write Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/exploit/local/windowskernel' require 'rex' class Metasploit3 'Windows tcpip.sys Arbitrary Write Privilege Escalation', 'Description' ...

Malwarebytes Anti-Malware / Anti-Exploit Update Remote Code Execution Exploit

This Metasploit module exploits a vulnerability in the update functionality of Malwarebytes Anti-Malware consumer before 2.0.3 and Malwarebytes Anti-Exploit consumer 1.03.1.1220. Due to the lack of proper update package validation a man-in-the-middle attacker could execute arbitrary code by...

WordPress Platform Theme Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Remote Code Execution in Wordpress Platform Theme', 'Description' = %q The Wordpress Theme "platform" contains a remote code executi...

WordPress Pixabay Images PHP Code Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit3 'Wordpress Pixabay Images PHP Code Upload', 'Description' = %q This module exploits multiple vulnerabilities in the Wordpress plugin Pixabay Images 2.3....

WordPress Pixabay Images PHP Code Upload Exploit

This Metasploit module exploits multiple vulnerabilities in the WordPress plugin Pixabay Images version 2.3.6. The plugin does not check the host of a provided download URL which can be used to store and execute malicious PHP code on the system. This module requires Metasploit:...

WordPress Platform Theme Remote Code Execution Exploit

The Wordpress Theme "platform" contains a remote code execution vulnerability through an unchecked admininit call. The theme includes the uploaded file from it's temp filename with php's include function. This module requires Metasploit: http://metasploit.com/download Current source:...

MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape Exploit

This Metasploit module abuses a process creation policy in Internet Explorer's sandbox, specifically the Microsoft Remote Desktop Services Web Proxy IE one, which allows the attacker to escape the Protected Mode, and execute code with Medium Integrity. At the moment, this module only bypass...

Microsoft Remote Desktop Services - Web Proxy IE Sandbox Escape (MS15-004) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape', 'Description' = %q This module abuses a process creation...

MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection

This module exploits a universal cross-site scripting UXSS vulnerability found in Internet Explorer 10 and 11. By default, you will steal the cookie from TARGETURI which cannot have X-Frame-Options or it will fail. You can also have your own custom JavaScript by setting the CUSTOMJS option. Lastl...

Windows Gather User Credentials (phishing)

This module is able to perform a phishing attack on the target by popping up a loginprompt. When the user fills credentials in the loginprompt, the credentials will be sent to the attacker. The module is able to monitor for new processes and popup a loginprompt when a specific process is starting...

WordPress XMLRPC GHOST Vulnerability Scanner

This module can be used to determine hosts vulnerable to the GHOST vulnerability via a call to the WordPress XMLRPC interface. If the target is vulnerable, the system will segfault and return a server error. On patched systems, a normal XMLRPC error is returned. This module requires Metasploit:...

Heap overflow in glibc 2.2 name resolution (CVE-2015-0235)

Heap-based buffer overflow in the nsshostnamedigitsdots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the 1 gethostbyname or 2 gethostbyname2 function, aka "GHOST."...

Oracle Weblogic Server Deserialization RCE - Raw Object

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object weblogic.jms.common.StreamMessageImpl to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializerawobject msf...

Multi Gather RubyGems API Key

This module obtains a user's RubyGems API key from /.gem/credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather RubyGems API Key', 'Description' = %q This module obtains a...

Arris VAP2500 tools_command.php Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Arris VAP2500 toolscommand.php Command Execution', 'Description' = %q Arris VAP2500 access points are vulnerable to OS command...

Arris VAP2500 Command Execution Exploit

Arris VAP2500 access points are vulnerable to OS command injection in the web management portal via the toolscommand.php page. Though authentication is required to access this page, it is trivially bypassed by setting the value of a cookie to an md5 hash of a valid username. This module requires...

Oracle DB Privilege Escalation via Function-Based Index

This module will escalate an Oracle DB user to DBA by creating a function-based index on a table owned by a more-privileged user. Credits to David Litchfield for publishing the technique. Module Options msf use auxiliary/admin/oracle/oracle/indexprivesc msf undefinedindexprivesc show actions...

WordPress Platform Theme File Upload Vulnerability

The WordPress Theme "platform" contains a remote code execution vulnerability through an unchecked admininit call. The theme includes the uploaded file from its temp filename with php's include function. Module Options msf use exploit/unix/webapp/wp/platformexec msf undefinedplatformexec show...