JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. Module Options msf use exploit/multi/http/jboss/bshdeployer msf...

JBoss Java Class DeploymentFileRepository WAR Deployment

This module uses the DeploymentFileRepository class in JBoss Application Server jbossas to deploy a JSP file which then deploys the WAR file. Module Options msf use exploit/multi/http/jboss/deploymentfilerepository msf undefineddeploymentfilerepository show actions ...actions... msf...

WM Downloader 3.0.0.9 - Local Buffer Overflow (Metasploit)

WM Downloader 3.0.0.9 - Local Buffer Overflow Metasploit This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

Xftp FTP Client 3.0 PWD Remote Buffer Overflow

This module exploits a buffer overflow in the Xftp 3.0 FTP client that is triggered through an excessively long PWD message. Module Options msf use exploit/windows/ftp/xftp/clientpwd msf undefinedclientpwd show actions ...actions... msf undefinedclientpwd set ACTION msf undefinedclientpwd show...

Java Runtime Environment Soundbank Resource Name Stack Buffer Overflow

Added: 04/22/2010 CVE: CVE-2010-0839 BID: 39070 OSVDB: 63494 Background The Java Runtime Environment JRE is part of the Java Development Kit JDK, a set of programming tools for developing Java applications. The JRE Java programming class library contains the Java Sound Application Interface API t...

Java Runtime Environment Soundbank Resource Name Stack Buffer Overflow

Added: 04/22/2010 CVE: CVE-2010-0839 BID: 39070 OSVDB: 63494 Background The Java Runtime Environment JRE is part of the Java Development Kit JDK, a set of programming tools for developing Java applications. The JRE Java programming class library contains the Java Sound Application Interface API t...

Sun Java Web Start command-line argument injection

Added: 04/20/2010 CVE: CVE-2010-0886 BID: 39492 OSVDB: 63798 Background Sun Java Web Start allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment JRE. Problem A vulnerability in Sun Java Web Start allows execution of arbitrary commands which are...

Sun Java Web Start command-line argument injection

Added: 04/20/2010 CVE: CVE-2010-0886 BID: 39492 OSVDB: 63798 Background Sun Java Web Start allows standalone Java applications, called JNLP files, to be executed by the Java Runtime Environment JRE. Problem A vulnerability in Sun Java Web Start allows execution of arbitrary commands which are...

Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference

This module exploits an out of bounds function table dereference in the SMB request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7 release candidates not RTM, and Windows 2008 Server prior to R2. Windows Vista without SP1 does not seem affected by this flaw. This...

Nagios statuswml.cgi Command Injection

Added: 04/13/2010 CVE: CVE-2009-2288 BID: 35464 OSVDB: 55281 Background Nagios is a network host and service monitoring and management system. Problem The Nagios statuswml.cgi script passes unsanitized data to the ping and traceroute commands, resulting in shell command execution via...

Nagios statuswml.cgi Command Injection

Added: 04/13/2010 CVE: CVE-2009-2288 BID: 35464 OSVDB: 55281 Background Nagios is a network host and service monitoring and management system. Problem The Nagios statuswml.cgi script passes unsanitized data to the ping and traceroute commands, resulting in shell command execution via...

Nagios statuswml.cgi Command Injection

Added: 04/13/2010 CVE: CVE-2009-2288 BID: 35464 OSVDB: 55281 Background Nagios is a network host and service monitoring and management system. Problem The Nagios statuswml.cgi script passes unsanitized data to the ping and traceroute commands, resulting in shell command execution via...

Trellian FTP Client 3.01 PASV Remote Buffer Overflow

This module exploits a buffer overflow in the Trellian 3.01 FTP client that is triggered through an excessively long PASV message. Module Options msf use exploit/windows/ftp/trellian/clientpasv msf undefinedclientpasv show actions ...actions... msf undefinedclientpasv set ACTION msf...

Internet Explorer Tabular Data Control ActiveX Memory Corruption

$Id: ms10018ietabularactivex.rb 9018 2010-04-05 20:25:56Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit)

$Id: lsatransnamesheap.rb 9021 2010-04-05 23:34:10Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

Samba 3.0.24 (Solaris) - 'lsa_io_trans_names' Heap Overflow (Metasploit)

$Id: lsatransnamesheap.rb 9021 2010-04-05 23:34:10Z hdm $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framewor...

AjaXplorer checkInstall.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the AjaXplorer 'checkInstall.php' script. All versions of AjaXplorer prior to 2.6 are vulnerable. Module Options msf use exploit/multi/http/ajaxplorer/checkinstallexec msf undefinedcheckinstallexec show actions ...actions... msf...

Internet Explorer iepeers.dll use-after-free vulnerability

Added: 04/02/2010 CVE: CVE-2010-0806 BID: 38615 OSVDB: 62810 Background The iepeers.dll component of Internet Explorer provides support for Web Folders and printing. Problem A vulnerability in iepeers.dll allows a specially crafted web page to cause a pointer to be used after it has been freed,...

Immunity Canvas: JAVA_DESERIALIZE2

Name| javadeserialize2 ---|--- CVE| CVE-2010-0094 Exploit Pack| CANVAS Description| javadeserialize2 Notes| CVE Name: CVE-2010-0094 VENDOR: Sun OSVDB: http://osvdb.org/show/osvdb/63484 Repeatability: Infinite client side - no crash References:...

Java Statement.invoke() Trusted Method Chain Privilege Escalation

This module exploits a vulnerability in Java Runtime Environment that allows an untrusted method to run in a privileged context. The vulnerability affects version 6 prior to update 19 and version 5 prior to update 23. Module Options msf use exploit/multi/browser/java/trustedchain msf...