ColdFusion 8.0.1 Arbitrary File Upload and Execute

This module exploits the Adobe ColdFusion 8.0.1 FCKeditor 'CurrentFolder' File Upload and Execute vulnerability. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ColdFusion 8.0.1 Arbitrary File...

Adobe Flash Player - 'Button' Arbitrary Code Execution (Metasploit)

$Id: adobeflashplayerbutton.rb 10857 2010-11-01 22:34:13Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. Module Options msf use...

Mozilla Firefox Interleaved document.write/appendChild Memory Corruption

This module exploits a code execution vulnerability in Mozilla Firefox caused by interleaved calls to document.write and appendChild. This module was written based on a live exploit found in the wild. Module Options msf use exploit/windows/browser/mozilla/interleavedwrite msf...

MOXA Device Manager Tool 2.1 Buffer Overflow

This module exploits a stack buffer overflow in MOXA MDM Tool 2.1. When sending a specially crafted MDMGw MDM2Gateway response, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/scada/moxa/mdmtool msf undefinedmdmtool show actions ...actions... msf...

MOXA Device Manager Tool 2.1 - Buffer Overflow (Metasploit)

MOXA Device Manager Tool 2.1 - Buffer Overflow Metasploit. CVE-2010-4741. Local exploit for Windows platform This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MOXA Device Manager Tool 2.1 Buffer...

JBoss JMX - Console Deployer Upload and Execute (Metasploit)

$Id: jbossmaindeployer.rb 10754 2010-10-19 22:24:33Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

MOXA MediaDBPlayback ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in MOXAActiveXSDK. When sending an overly long string to the PlayFileName of MediaDBPlayback.DLL 2.2.0.5 an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/fileformat/moxa/mediadbplayback msf...

IBM Tivoli Storage Manager FastBack Mount Service Code Execution

Added: 10/18/2010 CVE: CVE-2010-3058 BID: 42549 OSVDB: 67292 Background IBM Tivoli Storage Manager TSM provides centralized management for automated backup and restoration operations. TSM includes FastBack, which provides a client/server backup solution for the MS Windows environment. FastBack...

DATAC RealWin SCADA Server SCPC_INITIALIZE_RF Buffer Overflow

This module exploits a stack buffer overflow in DATAC Control International RealWin SCADA Server 2.0 Build 6.1.8.10. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/scada/realwin/scpcinitializerf msf...

DATAC RealWin SCADA Server SCPC_INITIALIZE Buffer Overflow

This module exploits a stack buffer overflow in DATAC Control International RealWin SCADA Server 2.0 Build 6.1.8.10. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/scada/realwin/scpcinitialize msf...

Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.CREATE_CHANGE_SET

The module exploits an sql injection flaw in the CREATECHANGESET procedure of the PL/SQL package DBMSCDCPUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTECATALOGROLE have the required privilege. Module Options msf u...

FTPShell 5.1 Stack Buffer Overflow

This module exploits a stack buffer overflow in FTPShell 5.1. The overflow gets triggered when the ftp client tries to process an overly long response to a PWD command. This will overwrite the saved EIP and structured exception handler. Module Options msf use exploit/windows/ftp/ftpshell51/pwdrep...

Sun Java Web Start BasicServiceImpl Code Execution

This module exploits a vulnerability in Java Runtime Environment that allows an attacker to escape the Java Sandbox. By injecting a parameter into a javaws call within the BasicServiceImpl class the default java sandbox policy file can be therefore overwritten. The vulnerability affects version 6...

AASync v2.2.1.0 (Win32) Stack Buffer Overflow (LIST)

This module exploits a stack buffer overflow in AASync v2.2.1.0, triggered when processing the response on a LIST command. During the overflow, a structured exception handler record gets overwritten. Module Options msf use exploit/windows/ftp/aasync/listreply msf undefinedlistreply show actions...

HP OpenView Network Node Manager (OV NNM) 7.53/7.51 - 'OVAS.exe' Stack Buffer Overflow (Metasploit)

$Id: hpnnmovas.rb 10660 2010-10-12 18:39:21Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ Th...

FTPGetter Standard v3.55.0.05 Stack Buffer Overflow (PWD)

This module exploits a buffer overflow in FTPGetter Standard v3.55.0.05 ftp client. When processing the response on a PWD command, a stack based buffer overflow occurs. This leads to arbitrary code execution when a structured exception handler gets overwritten. Module Options msf use...

Seagull FTP v3.3 Build 409 Stack Buffer Overflow

This module exploits a buffer overflow in the Seagull FTP client that gets triggered when the ftp client processes a response to a LIST command. If the response contains an overly long file/folder name, a buffer overflow occurs, overwriting a structured exception handler. Module Options msf use...

LeapFTP 3.0.1 Stack Buffer Overflow

This module exploits a buffer overflow in the LeapFTP 3.0.1 client. This issue is triggered when a file with a long name is downloaded/opened. Module Options msf use exploit/windows/ftp/leapftp/listreply msf undefinedlistreply show actions ...actions... msf undefinedlistreply set ACTION msf...

Gekko Manager FTP Client Stack Buffer Overflow

This module exploits a buffer overflow in Gekko Manager ftp client, triggered when processing the response received after sending a LIST request. If this response contains a long filename, a buffer overflow occurs, overwriting a structured exception handler. Module Options msf use...