Veritas NetBackup Remote Command Execution

No description provided by source. $Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require...

ShixxNOTE 6.net Font Field Overflow

This module exploits a buffer overflow in ShixxNOTE 6.net. The vulnerability is caused due to boundary errors in the handling of font fields. Module Options msf use exploit/windows/misc/shixxnote/font msf undefinedfont show actions ...actions... msf undefinedfont set ACTION msf undefinedfont show...

TWiki Search Function Arbitrary Command Execution

This module exploits a vulnerability in the search component of TWiki. By passing a 'search' parameter containing shell metacharacters to a 'Search' script, an attacker can execute arbitrary OS commands. Affected versions: - 20040901 - 20030201 - 20011201 - 20001201 - SVN up to and including...

Motorola WR850G v4.03 Credentials

Login credentials to the Motorola WR850G router with firmware v4.03 can be obtained via a simple GET request if issued while the administrator is logged in. A lot more information is available through this request, but you can get it all and more after logging in. Module Options msf use...

Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in the Zinf Audio Player 2.2.1. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an embedded PLS file within a browser, when the PLS extension is registered ...

Mercantec SoftCart CGI Overflow

This is an exploit for an undisclosed buffer overflow in the SoftCart.exe CGI as shipped with Mercantec's shopping cart software. It is possible to execute arbitrary code by passing a malformed CGI parameter in an HTTP GET request. This issue is known to affect SoftCart version 4.00b. Module...

Medal of Honor Allied Assault getinfo Stack Buffer Overflow

This module exploits a stack based buffer overflow in the getinfo command of Medal Of Honor Allied Assault. Module Options msf use exploit/windows/games/mohaa/getinfo msf undefinedgetinfo show actions ...actions... msf undefinedgetinfo set ACTION msf undefinedgetinfo show options ...show and set...

WebSTAR FTP Server USER Overflow

This module exploits a stack buffer overflow in the logging routine of the WebSTAR FTP server. Reliable code execution is obtained by a series of hops through the System library. Module Options msf use exploit/osx/ftp/webstar/ftpuser msf undefinedftpuser show actions ...actions... msf...

Unreal Tournament 2004 "secure" Overflow (Linux)

This is an exploit for the GameSpy secure query in the Unreal Engine. This exploit only requires one UDP packet, which can be both spoofed and sent to a broadcast address. Usually, the GameSpy query server listens on port 7787, but you can manually specify the port as well. The RunServer.sh scrip...

Unreal Tournament 2004 "secure" Overflow (Win32)

This is an exploit for the GameSpy secure query in the Unreal Engine. This exploit only requires one UDP packet, which can be both spoofed and sent to a broadcast address. Usually, the GameSpy query server listens on port 7787, but you can manually specify the port as well. The RunServer.sh scrip...

Squid NTLM Authenticate Overflow

This is an exploit for Squid's NTLM authenticate overflow libntlmssp.c. Due to improper bounds checking in ntlmcheckauth, it is possible to overflow the 'pass' variable on the stack with user controlled data of a user defined length. Props to iDEFENSE for the advisory. Module Options msf use...

Sasser Worm avserve FTP PORT Buffer Overflow

This module exploits the FTP server component of the Sasser worm. By sending an overly long PORT command the stack can be overwritten. Module Options msf use exploit/windows/ftp/sasser/ftpdport msf undefinedftpdport show actions ...actions... msf undefinedftpdport set ACTION msf undefinedftpdport...

AppleFileServer LoginExt PathName Overflow

This module exploits a stack buffer overflow in the AppleFileServer service on MacOS X. This vulnerability was originally reported by Atstake and was actually one of the few useful advisories ever published by that company. You only have one chance to exploit this bug. This particular exploit use...

Norton AntiSpam 2004 SymSpamHelper ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Norton AntiSpam 2004. When sending an overly long string to the LaunchCustomRuleWizard method of symspam.dll 2004.1.0.147 an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/nis2004/antispam msf...

ISS PAM.dll ICQ Parser Buffer Overflow

This module exploits a stack buffer overflow in the ISS products that use the iss-pam1.dll ICQ parser Blackice/RealSecure. Successful exploitation will result in arbitrary code execution as LocalSystem. This exploit only requires 1 UDP packet, which can be both spoofed and sent to a broadcast...

IBM DB2 db2rcmd.exe Command Execution Vulnerability

This module exploits a vulnerability in the Remote Command Server component in IBM's DB2 Universal Database 8.1. An authenticated attacker can send arbitrary commands to the DB2REMOTECMD named pipe which could lead to administrator privileges. Module Options msf use auxiliary/admin/db2/db2rcmd ms...

BolinTech Dream FTP Server 1.02 Format String

This module exploits a format string overflow in the BolinTech Dream FTP Server version 1.02. Based on the exploit by SkyLined. Module Options msf use exploit/windows/ftp/dreamftp/format msf undefinedformat show actions ...actions... msf undefinedformat set ACTION msf undefinedformat show options...

PSO Proxy v0.91 Stack Buffer Overflow

This module exploits a buffer overflow in the PSO Proxy v0.91 web server. If a client sends an excessively long string the stack is overwritten. Module Options msf use exploit/windows/http/psoproxy91/overflow msf undefinedoverflow show actions ...actions... msf undefinedoverflow set ACTION msf...

IMail LDAP Service Buffer Overflow

This exploits a buffer overflow in the LDAP service that is part of the IMail product. This module was tested against version 7.10 and 8.5, both running on Windows 2000. Module Options msf use exploit/windows/ldap/imail/thc msf undefinedthc show actions ...actions... msf undefinedthc set ACTION m...

MS03-049 Microsoft Workstation Service NetAddAlternateComputerName Overflow

This module exploits a stack buffer overflow in the NetApi32 NetAddAlternateComputerName function using the Workstation service in Windows XP. Module Options msf use exploit/windows/smb/ms03/049netapi msf undefined049netapi show actions ...actions... msf undefined049netapi set ACTION msf...