BusyBox DMZ Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to manage traffic forwarding to a target host through the BusyBox device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Android Meterpreter Browsable Launcher

This module allows you to open an android meterpreter via a browser. An Android meterpreter must be installed as an application beforehand on the target device in order to use this. For best results, you can consider using the auxiliary/client/sms/sendtext to trick your target into opening the...

Target Says SEC Won't Pursue Enforcement Action as a Result of Data Breach

Target officials say that the Securities and Exchange Commission, one of several U.S. agencies investigating the massive data breach at the company in 2013, has decided not to punish Target as a result of the breach. The Target data breach is one of the larger such incidents ever. The breach...

Microsoft Office 2007 OneTableDocumentStream Invalid Object Exploit

Microsoft Office 2007 suffers from a OneTableDocumentStream invalid object vulnerability. Source: https://code.google.com/p/google-security-research/issues/detail?id=171&can=1 The following access violation was observed in Microsoft Office 2007 Word document: 8c0.e68: Access violation - code...

Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064)

Microsoft Windows HTA HTML Application - Remote Code Execution MS14-064 !/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$reza; $msgd = "\x3c\x68\x74\x6d\x6c\x3e\x0d\x0a...

Microsoft Windows HTA (HTML Application) - Remote Code Execution Exploit

Microsoft Windows HTA HTML Application remote code execution exploit that leverages MS14-064. !/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$...

Netsparker 2.3.X - Remote Code Execution Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Title : Netsparker 2.3.X - Remote Code Execution Tested on Netsparker 2.3.x / Win 7 Author : Hesam Bazvand E-Mail : email protected FaceBook : https://www.facebook.com/hesam.king73 Twitter : https://twitter.com/hesamking73...

Adobe Flash Player Type Confusion (APSB15-16: CVE-2015-3122)

A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a type confusion condition while handling a malformed SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file. Successful...

Netsparker 2.3.x - Remote Code Execution

Netsparker 2.3.x - Remote Code Execution !/usr/bin/python Title : Netsparker 2.3.X - Remote Code Execution Tested on Netsparker 2.3.x / Win 7 Author : Hesam Bazvand E-Mail : [email protected] FaceBook : https://www.facebook.com/hesam.king73 Twitter : https://twitter.com/hesamking73 Exploit...

Netsparker 2.3.x - Remote Code Execution

!/usr/bin/python Title : Netsparker 2.3.X - Remote Code Execution Tested on Netsparker 2.3.x / Win 7 Author : Hesam Bazvand E-Mail : [email protected] FaceBook : https://www.facebook.com/hesam.king73 Twitter : https://twitter.com/hesamking73 Exploit MS14-064 CVE2014-6332 1 . run python code...

MS14-002 Windows NDProxy Privilege Escalation

/ Exploit Title: Windows NDProxy Privilege Escalation MS14-002 Date: 2015-08-03 Exploit Author: Tomislav Paskalev Vulnerable Software: Windows XP SP3 x86 Windows XP SP2 x86-64 Windows 2003 SP2 x86 Windows 2003 SP2 x86-64 Windows 2003 SP2 IA-64 Supported vulnerable software: Windows XP SP3 x86...

UBUNTU-CVE-2015-3439

Cross-site scripting XSS vulnerability in the Ephox formerly Moxiecode plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as...

DEBIAN-CVE-2015-3439

Cross-site scripting XSS vulnerability in the Ephox formerly Moxiecode plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as...

CVE-2015-3439

Cross-site scripting XSS vulnerability in the Ephox formerly Moxiecode plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as...

The vulnerability of the Firefox ESR browser, which allows a hacker to read data from uninitialized memory areas

The vulnerability of the CairoTextureClientD3D9::BorrowDrawTarget function in the implementation of the Direct3D 9 browser Firefox ESR is related to errors in the code. Exploiting this vulnerability allows a remote attacker to read data from uninitialized memory areas...

Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability (CNVD-2015-04963)

Cisco Unified Intelligence Center is a unified intelligence management center. A cross-site request forgery vulnerability exists in the Cisco Unified Intelligence Center WEB interface, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform...

EMC Documentum CenterStage Cross-Site Scripting Vulnerability

EMC Documentum CenterStage is a document management service. A cross-site scripting vulnerability in EMC Documentum CenterStage allows remote attackers to construct malicious URIs, trick users into parsing them, and perform malicious actions in the context of the target user...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

Cisco Identity Services Engine A centralized policy engine for Cisco TrustSec solutions. A cross-site request forgery vulnerability exists in the Cisco Identity Services Engine, which allows remote attackers to construct malicious URIs, trick users into resolving them, and perform malicious actio...

Adobe Flash Player BitmapData Remote Code Execution (APSA15-04: CVE-2015-5123)

A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to a type confusion condition while handling a malformed SWF file. A remote attacker can exploit this vulnerability by enticing a target user to open a specially crafted SWF file. Successful...

Cisco TelePresence IP Gateway Device Cross-Site Request Forgery Vulnerability

The Cisco TelePresence IP Gateway is a telepresence IP gateway device. A cross-site request forgery vulnerability exists in the Cisco TelePresence IP Gateway appliance that allows remote attackers to construct malicious URIs, trick users into parsing them, and can perform malicious actions in the...