Nvidia (nvsvc) Display Driver Service - Local Privilege Escalation (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' require 'msf/core/post/common' require 'msf/core/post/windows/priv' require 'msf/core/post/windows/process' require...

Microsoft Windows - 'ndproxy.sys' Local Privilege Escalation (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex' class Metasploit3 'Microsoft Windows ndproxy.sys Local Privilege Escalation', 'Description' = %q This module exploits a flaw in the...

Poison Ivy Command and Control Scanner

Enumerate Poison Ivy Command and Control C on ports 3460, 80, 8080 and 443. Adaptation of iTrust Python script. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Poison Ivy Command and Control...

IBM Forms Viewer栈缓冲区溢出漏洞

CVECAN ID: CVE-2013-5447 IBM Forms Viewer是其中的一个客户端程序，它能够打开、填写、签署、提交和保存XFDL表单，可作为独立的应用程序或以嵌入在Web浏览器内的方式显示表单。 IBM Forms Viewer 4.0.0.3之前的4.x版本和8.0.1.1前的8.x版本中存在基于栈的缓冲区溢出漏洞。远程攻击者可借助特制的XFDL表单利用该漏洞执行任意代码。 0 IBM Forms Viewer 4.0 IBM Forms Viewer 4.0.0.1 IBM Forms Viewer 4.0.0.2 IBM Forms Viewer 8.0 IBM...

Adobe ColdFusion 9 - Administrative Authentication Bypass (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...

HP LoadRunner EmulationAdmin - Web Service Directory Traversal (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rexml/document' class Metasploit3 /Apache-Coyote/1.1/ include REXML include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper...

Adobe ColdFusion 9 Administrative Login Bypass

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Adobe ColdFusion 9 Administrative Login Bypass', 'Description' = %q Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attacker...

MS13-097 Registry Symlink IE Sandbox Escape

This module exploits a vulnerability in Internet Explorer Sandbox which allows to escape the Enhanced Protected Mode and execute code with Medium Integrity. The vulnerability exists in the IESetProtectedModeRegKeyOnly function from the ieframe.dll component, which can be abused to force medium...

vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection', 'Description' = %q This module exploits a SQL injection...

IcoFX Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version 2.1 of IcoFX. The vulnerability exists while parsing .ICO files, where a specially crafted ICONDIR header providing an arbitrary long number of images in the file can be used to trigger the overflow when reading the...

OSX Gather Autologin Password as Root

This module will steal the plaintext password of any user on the machine with autologin enabled. Root access is required. When a user has autologin enabled System Preferences - Accounts, OSX stores their password with an XOR encoding in /private/etc/kcpassword. This module requires Metasploit:...

Eaton Network Shutdown Module 3.21 PHP Code Injection

!/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage Example: $ python eaton.py 192.168.1.9 "net user" User accounts for \ ------------------------------------------------------------------------------- Guest LocalAdmin The...

Up.Time Monitoring Station post2file.php Arbitrary File Upload

This Metasploit module exploits an arbitrary file upload vulnerability found within the Up.Time monitoring server 7.2 and below. A malicious entity can upload a PHP file into the webroot without authentication, leading to arbitrary code execution. This module requires Metasploit:...

Eaton Network Shutdown Module 3.21 PHP Code Injection

Eaton Network Shutdown module versions 3.21 and below suffer from a remote PHP code injection vulnerability. This is a python exploit for a previously disclosed finding. !/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage...

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection

Eaton Network Shutdown Module 3.21 - Remote PHP Code Injection !/usr/bin/env python Quick 'n' Dirty - Metasploit module didn't do it for me 2013 - Filip Waeytens - http://www.wsec.be Usage Example: $ python eaton.py 192.168.1.9 "net user" User accounts for \...

Zimbra Collaboration Server LFI

This module exploits a local file inclusion on Zimbra 8.0.2 and 7.2.2. The vulnerability allows an attacker to get the LDAP credentials from the localconfig.xml file. The stolen credentials allow the attacker to make requests to the service/admin/soap API. This can then be used to create an...

[Wireless Attack Toolkit (WAT)] A push-button wireless hacking and Man-in-the-Middle attack toolkit

This project is designed to run on Embedded ARM platforms specifically v6 and RaspberryPi but I'm working on more. It provides users with automated wireless attack tools that air paired with man-in-the-middle tools to effectively and silently attack wireless clients. Some of the tools included in...

Kaseya uploadImage Arbitrary File Upload

This Metasploit module exploits an arbitrary file upload vulnerability found in Kaseya versions below 6.3.0.2. A malicious user can upload an ASP file to an arbitrary directory without previous authentication, leading to arbitrary code execution with IUSR privileges. This module requires...

WordPress OptimizePress Theme File Upload

This Metasploit module exploits a vulnerability found in the the Wordpress theme OptimizePress. The vulnerability is due to an insecure file upload on the media-upload.php component, allowing an attacker to upload arbitrary PHP code. This Metasploit module has been tested successfully on...

Cisco Prime Data Center Network Manager - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Cisco Prime Data Center Network Manager Arbitrary File Upload', 'Description' = %q This module exploits a code execution flaw in Cisc...