Total Video Player 1.3.1 - 'Settings.ini' Local Buffer Overflow (SEH) (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Total Video Player 1.3.1 Settings.ini - SEH Buffer Overflow', 'Description' = %q This module exploits a buffer overflow in Total Vid...

Linux Reboot

A very small shellcode for rebooting the system. This payload is sometimes helpful for testing purposes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 32 include...

Symantec Endpoint Protection Manager Remote Command Execution

This Metasploit module exploits XXE and SQL injection flaws in Symantec Endpoint Protection Manager versions 11.0, 12.0 and 12.1. When supplying a specially crafted XXE request an attacker can reach SQL injection affected components. As xpcmdshell is enabled in the included database instance, it'...

Simple E-Document‘upload.php’任意文件上传漏洞

Bugtraq ID:65175 Simple E-Document是TECOrange团队开发的一套专用于接收大量邮件的办公室、组织和个人文档管理系统。 Simple E-Document中存在任意文件上传漏洞，该漏洞源于程序没有充分过滤用户提交的输入。攻击者可利用该漏洞上传任意文件，导致在受影响应用程序上下文中执行任意代码。Simple E-Document 1.31版本中存在漏洞，其他版本也可能受到影响。 0 Simple E-Document 1.31 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Windows Command Shell, Hidden Bind TCP Inline

Listen for a connection from certain IP and spawn a command shell. The shellcode will reply with a RST packet if the connections is not coming from the IP defined in AHOST. This way the port will appear as "closed" helping us to hide the shellcode. This module requires Metasploit:...

Metasploit Module Targets Old Android Vulnerability

Android devices prior to version 4.2.1 of the operating system—70 percent of the phones and tablets in circulation—have been vulnerable to a serious and simple remote code execution vulnerability in the Android browser for more than 93 weeks. Metasploit recently added an exploit module that targe...

MediaWiki Thumb.php Remote Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MediaWiki Thumb.php Remote Command Execution', 'Description' = %q MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x...

Audiotran - '.pls' Local Stack Buffer Overflow (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Audiotran PLS File Stack Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow in Audiotran 1.4.2.4...

Audiotran PLS File Stack Buffer Overflow

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Audiotran PLS File Stack Buffer Overflow', 'Description' = %q This module exploits a stack-based buffer overflow in Audiotran 1.4.2.4...

MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'MediaWiki Thumb.php Remote Command Execution', 'Description' = %q MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x...

Barracuda Load Balancer‘/cgi-mod/index.cgi’远程命令注入漏洞

BUGTRAQ ID: 65508 Barracuda Load Balancer是美国梭子鱼（Barracuda Networks）公司的一款应用交付控制器。该控制器提供对入侵和攻击事件的防护功能，并同时优化应用负载和提供强大的性能支持。 Barracuda Load Balancer中存在远程命令注入漏洞。攻击者可利用该漏洞在受影响应用程序上下文中执行任意命令。Barracuda Load Balancer 340 4.2.2.007版本中存在漏洞，其他版本也可能受到影响。 0 Barracuda Load Balancer 340 4.2.2.007...

Oracle Forms / Reports Remote Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class Metasploit3 'Oracle Forms and Reports Remote Code Execution', 'Description' = %q This module uses two vulnerabilities in Oracle form...

Oracle Forms and Reports - Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class Metasploit3 'Oracle Forms and Reports Remote Code Execution', 'Description' = %q This module uses two vulnerabilities in Oracle form...

Oracle Forms / Reports Remote Code Execution Exploit

This Metasploit module uses two vulnerabilities in Oracle forms and reports to get remote code execution on the host. The showenv url can be used to disclose information about a server. A second vulnerability that allows arbitrary reading and writing to the host filesystem can then be used to wri...

[pMap v1.10] Passive Discovery, Scanning, and Fingerprinting

Discovery, Scanning, and Fingerprinting via Broadcast and Multicast Traffic Features Reveals open TCP and UDP ports Uses UDP, mDNS, and SSDP to identify PCs, NAS, Printers, Phones, Tablets, CCTV, DVR, and Others Device Type, Make, and Model Operating Systems and Version Service Versions and...

Reflective DLL Injection, Reverse Hop HTTP/HTTPS Stager

Inject a DLL via a reflective loader. Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Meterpreter (Reflective Injection), Reverse Hop HTTP/HTTPS Stager

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop. This module requires Metasploit:...

VNC Server (Reflective Injection), Reverse Hop HTTP/HTTPS Stager

Inject a VNC Dll via a reflective loader staged. Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop. This module requires Metasploit: https://metasploit.com/download Current source:...

Dexter (CasinoLoader) SQL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "Dexter CasinoLoader SQL Injection", 'Description' = %q This module exploits a vulnerability found in the command and control panel us...

Dexter CasinoLoader SQL Injection Vulnerability

This Metasploit module exploits a vulnerability found in the command and control panel used to control Dexter Point of Sale malware. This is done by accessing the PHP page used by bots to report in gateway.php which does not sanitize input. Input is encrypted and encoded, but the key is supplied ...