Immunity Canvas: SSH_ENUM

Name| sshenum ---|--- CVE| CVE-2018-15473 Exploit Pack| CANVAS Description| sshenum Notes| CVE Name: CVE-2018-15473 VENDOR: The OpenBSD Project NOTES: Module will use different techniques in order to enumerate users on target hosts As for the file containing usernames, they should be one per line...

Immunity Canvas: SAMBA_IS_KNOWN_PIPENAME

Name| sambaisknownpipename ---|--- CVE| CVE-2017-7494 Exploit Pack| CANVAS Description| SAMBA 4.x remote exploit Notes| References: https://www.samba.org/samba/security/CVE-2017-7494.html CVE Name: CVE-2017-7494 VENDOR: Samba Notes: In order to use this exploit you need: Write access to a SAMBA...

Immunity Canvas: DOKUWIKI_EXEC

Name| dokuwikiexec ---|--- CVE| CVE-2006-2878 Exploit Pack| CANVAS Description| DokuWiki Spell Checker Embedded Link Arbitrary PHP Code Execution Notes| CVE Name: CVE-2006-2878 VENDOR: DokuWiki Repeatability: Infinite References: 'http://www.hardened-php.net/advisory042006.119.html' CVSS: 7.5 DOR...

Immunity Canvas: PROFTPD_MOD_COPY

Name| proftpdmodcopy ---|--- CVE| CVE-2015-3306 Exploit Pack| CANVAS Description| ProFTPd 1.3.5 Remote File Copy Notes| CVE Name: CVE-2015-3306 VENDOR: NOTES: This exploit abuses the commands of the modcopy module in ProFTPd version=1.3.5. The SITE CPFR/CPTO commands can be used by unauthenticate...

Immunity Canvas: SSRS_VIEWSTATE_RCE

Name| ssrsviewstaterce ---|--- CVE| CVE-2020-0618 Exploit Pack| CANVAS Description| ssrsviewstaterce Notes| CVE Name: CVE-2020-0618 VENDOR: Microsoft NOTES: This exploit has been tested on SQL Server 2016 VersionsAffected: VERSIONS Repeatability: Infinite References:...

Immunity Canvas: SPECTRE_FILE_LEAK

Name| spectrefileleak ---|--- CVE| CVE-2017-5753 Exploit Pack| CANVAS Description| Spectre File Leak Notes| CVE Name: CVE-2017-5753 Notes: This module gives an unpriviledged user the ability to dump a file from the kernel memory. A common scenario is to dump the /etc/shadow or kerberos tickets...

Immunity Canvas: IIS_MACHINEKEY

Name| iismachinekey ---|--- CVE| NO-CVE Exploit Pack| CANVAS Description| Microsoft IIS MachineKey ViewState Deserialization RCE Notes| CVE Name: NO-CVE VENDOR: http://microsoft.com Notes: IMPORTANT NOTES 3/30/2018: | Test | ind. systems verified | iismachinekey success |...

Immunity Canvas: ETERNALBLUE

Name| ETERNALBLUE ---|--- CVE| CVE-2017-0143 Exploit Pack| CANVAS Description| ETERNALBLUE Notes| CVE Name: CVE-2017-0143 VENDOR: Microsoft NOTES: Due to the complexity of the bug, this exploit will never be 100% reliable. Please READ THE EXPLOIT SOURCE for more information and notes...

Immunity Canvas: SMBGHOST

Name| SMBGHOST ---|--- CVE| CVE-2020-0796-1 Exploit Pack| CANVAS Description| SMBGHOST Notes| CVE Name: CVE-2020-0796 VENDOR: Microsoft NOTES: some notes here VersionsAffected: VERSIONS Repeatability: None References:...

Immunity Canvas: OFFICE_WSDL

Name| officewsdl ---|--- CVE| CVE-2017-8759, CVE-2017-8570 Exploit Pack| CANVAS Description| Microsoft Office Moniker/WSDL C Injection Notes| CVE Name: CVE-2017-8759, CVE-2017-8570 VENDOR: https://office.com Notes: Send the resulting document to someone and have them open it. If the target is...

Immunity Canvas: STRUTS_OGNL

Name| strutsognl ---|--- CVE| CVE-2017-5638 Exploit Pack| CANVAS Description| strutsognl Notes| CVE Name: CVE-2017-5638 VENDOR: Apache NOTES: The JAR Server will listen on the port provided in the UI. However, if that port is unavailable, a random one will be chosen. Example vulnerable applicatio...

Immunity Canvas: MS16_135

Name| ms16135 ---|--- CVE| CVE-2016-0099 Exploit Pack| CANVAS Description| MS16-135 SetWindowLongPtr Vulnerability Notes| CVE Name: CVE-2016-0099 VENDOR: Microsoft Notes: The vulnerable and now patched function is actually xxxNextWindow, but since Google mentioned SetWindowLongPtr in their releas...

Immunity Canvas: WEBLOGIC_T3_DESERIALIZATION

Name| weblogict3deserialization ---|--- CVE| CVE-2015-4852 Exploit Pack| CANVAS Description| weblogict3deserialization Notes| CVE Name: CVE-2015-4852 VENDOR: Oracle NOTES: IMPORTANT NOTE: Any instance of this application running Apache Commons Collections version prior to 3.0 WILL NOT WORK...

Immunity Canvas: IIS6_PROPFIND

Name| iis6propfind ---|--- CVE| CVE-2017-7269 Exploit Pack| CANVAS Description| IIS 6.0 PROPFIND ScStoragePathFromUrl Stack Buffer Overflow Notes| References: 'https://vulners.com/cve/CVE-2017-7269', 'https://github.com/edwardz246003/IISexploit' CVE Name: CVE-2017-7269 VENDOR: Microsoft...

Immunity Canvas: MS17_010

Name| ms17010 ---|--- CVE| CVE-2017-0143, CVE-2017-0146 Exploit Pack| CANVAS Description| MS17-010 Notes| CVE Name: CVE-2017-0143, CVE-2017-0146 VENDOR: Microsoft NOTES: https://github.com/worawit/MS17-010 https://www.crowdstrike.com/blog/badrabbit-ms17-010-exploitation-part-one-leak-and-control/...

Immunity Canvas: TOMCAT_FILE_UPLOAD

Name| tomcatfileupload ---|--- CVE| CVE-2017-12615 Exploit Pack| CANVAS Description| Tomcat - Arbitrary File Upload CVE-2017-12615 Notes| Repeatability: VENDOR: Apache CVE Url: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12615 CVE Name: CVE-2017-12615...

Immunity Canvas: MS01_033

Name| ms01033 ---|--- CVE| CVE-2001-0500 Exploit Pack| CANVAS Description| IIS 5.0 Index Server ISAPI .ida Overflow Notes| CVE Name: CVE-2001-0500 VENDOR: Microsoft MSADV: MS01-033 VersionsAffected: Repeatability: References: http://www.microsoft.com/technet/security/bulletin/MS01-033.mspx CVE Ur...

Immunity Canvas: ROUNDCUBE

Name| roundcube ---|--- CVE| CVE-2008-5619 Exploit Pack| CANVAS Description| RoundCube Code Execution Notes| CVE Name: CVE-2008-5619 VENDOR: Roundcube.net Repeatability: Infinite CVE Url: https://vulners.com/cve/CVE-2008-5619 References: 'None' CVSS: 10.0...

Immunity Canvas: JENKINS_XSTREAM_RCE

Name| jenkinsxstreamrce ---|--- CVE| CVE-2017-2068 Exploit Pack| CANVAS Description| jenkinsxstreamrce Notes| CVE Name: CVE-2017-2068 VENDOR: Jenkins NOTES: XStream-based APIs in Jenkins CI previous to version 2.44 are vulnerable to a remote code execution vulnerability involving the...

Immunity Canvas: JBOSS6_JMXINVOKERSERVLET_DESERIALIZE

Name| jboss6jmxinvokerservletdeserialize ---|--- CVE| CVE-2015-7501 Exploit Pack| CANVAS Description| jboss6jmxinvokerservletdeserialize Notes| CVE Name: CVE-2015-7501 VENDOR: Red Hat NOTES: IMPORTANT NOTE: Any instance of this application running Apache Commons Collections version prior to 3.0...

Immunity Canvas: HP_IMC_RCE

Name| hpimcrce ---|--- CVE| CVE-2017-5816 Exploit Pack| CANVAS Description| HP iMC Plat 7.2 dbman Code Execution Linux Notes| References: http://www.zerodayinitiative.com/advisories/ZDI-17-340/ Repeatability: Infinite VENDOR: Hewlett Packard CVE Url:...

Immunity Canvas: SPECTRE_SAM_LEAK

Name| spectresamleak ---|--- CVE| CVE-2017-5753-1 Exploit Pack| CANVAS Description| Spectre Sam Leak Notes| CVE Name: CVE-2017-5753 Notes: The final version should also handle Windows 2016 and 10. In fact the backend is perfectly working on Windows 2016 but libwincreds is not able to deal with...

Immunity Canvas: HPE_ILO4_ADDNEWADMIN

Name| hpeilo4addNewAdmin ---|--- CVE| CVE-2017-12542 Exploit Pack| CANVAS Description| HPE iLO 4 - AddNewAdmin Notes| CVE Name: CVE-2017-12542 VENDOR: Hewlett Packard Enterprise Changelog: Notes: Vulnerable versions: HPE iLO 4 2.53 References:...

Immunity Canvas: LINUX_FOLL_WRITE_COW

Name| linuxfollwritecow ---|--- CVE| CVE-2016-5195 Exploit Pack| CANVAS Description| Linux Kernel FOLLWRITE gup COW local privilege escalation Notes| Repeatability: Multiple Times Notes: Tested on: - RedHat 7 - Ubuntu 14 - Ubuntu 16 VENDOR: Linux CVE Url: https://vulners.com/cve/CVE-2016-5195...

Immunity Canvas: SPECIAL_LNK

Name| speciallnk ---|--- CVE| CVE-2017-8464 Exploit Pack| CANVAS Description| speciallnk Notes| References: 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464', 'http://paper.seebug.org/357/', 'http://www.vxjump.net/files/vulnanalysis/cve-2017-8464.txt' CVE Name:...

Immunity Canvas: STRUTS2_DMI_RCE

Name| struts2dmirce ---|--- CVE| CVE-2016-3081 Exploit Pack| CANVAS Description| struts2dmirce Notes| CVE Name: CVE-2016-3081 VENDOR: Apache NOTES: The JAR Server will listen on the port provided in the UI. However, if that port is unavailable, a random one will be chosen. Example vulnerable...

Immunity Canvas: UNMARSHAL_TO_SYSTEM

Name| unmarshaltosystem ---|--- CVE| CVE-2018-0824 Exploit Pack| CANVAS Description| CVE-2018-0824 QC Marshal Interceptor Insecure COM Unmarshal LPE Notes| CVE Name: CVE-2018-0824 VENDOR: Microsoft Notes: Tested against: --------------- Windows 7 x86 - NOT VULNERABLE Windows Server 2016 - NOT...

Immunity Canvas: JQUERY_FILE_UPLOAD

Name| jqueryfileupload ---|--- CVE| CVE-2018-9206 Exploit Pack| CANVAS Description| Blueimp jQuery-File-Upload Arbitrary Upload Notes| CVE Name: CVE-2018-9206 VENDOR: Notes: The exploit tests different paths on the target server Repeatability: Infinite References:...

Immunity Canvas: SHOW_TIMER_LEAK

Name| showtimerleak ---|--- CVE| CVE-2017-18344 Exploit Pack| CANVAS Description| showtimerleak Notes| CVE Name: CVE-2017-18344 NOTES: This module gives an unpriviledged user the ability to dump a file from the kernel memory. A common scenario is to dump the /etc/shadow or kerberos tickets. Note:...

Immunity Canvas: MS16_032

Name| ms16032 ---|--- CVE| CVE-2016-0099 Exploit Pack| CANVAS Description| MS16-032 Seclogon Thread Handle Leak Notes| CVE Name: CVE-2016-0099 VENDOR: Microsoft Notes: Our exploit module is really two modules: 1 An exploit, based off of Google Project Zero's post by James Foreshaw. It is extremel...

Immunity Canvas: OVERLAYFS

Name| overlayfs ---|--- CVE| CVE-2015-1328 Exploit Pack| CANVAS Description| Ubuntu Overlayfs local privilege escalation Notes| CVE Name: CVE-2015-1328 VENDOR: Ubuntu Notes: This is a local privilege escalation for Ubuntu affecting 12.04, 14.04, 14.10, and 15.04. Currently supporting: - 14.04 -...

Immunity Canvas: GOAHEAD_ENV_RCE

Name| goaheadenvrce ---|--- CVE| CVE-2017-17562 Exploit Pack| CANVAS Description| GoAhead 3.6.5 Remote Code Exec Notes| References: https://www.elttam.com.au/blog/goahead/ Repeatability: Unlimited VENDOR: EmbedThis Software CVE Url: https://nvd.nist.gov/vuln/detail/CVE-2017-17562 CVE Name:...

Immunity Canvas: DMESG_LEAK

Name| dmesgleak ---|--- CVE| CVE-2018-14656 Exploit Pack| CANVAS Description| dmesgleak Notes| CVE Name: CVE-2018-14656 NOTES: This module gives an unpriviledged user the ability to dump a file from the kernel memory. A common scenario is to dump the /etc/shadow or kerberos tickets. Note: This on...

Immunity Canvas: NTFS3G_MODPROBE

Name| ntfs3gmodprobe ---|--- CVE| CVE-2017-0358 Exploit Pack| CANVAS Description| ntfs-3g local privilege escalation Notes| CVE Name: CVE-2017-0358 VENDOR: GNU Notes: Tested and working on: Debian 8.8 jessie 64 bits Linux 3.16.0-4-amd64 1 SMP Debian 3.16.43-2+deb8u2 2017-06-26 x8664 GNU/Linux...

Immunity Canvas: JOOMLA_SESSION_UNSERIALIZE

Name| joomlasessionunserialize ---|--- CVE| CVE-2015-8562 Exploit Pack| CANVAS Description| Joomla session unserialize 1.5 to 3.4.5 Notes| Repeatability: Infinite VENDOR: Joomla CVE Url: https://vulners.com/cve/CVE-2015-8562 CVE Name: CVE-2015-8562...

Immunity Canvas: COUCHDB_ROLES

Name| couchdbroles ---|--- CVE| CVE-2017-12635 Exploit Pack| CANVAS Description| Apache CouchDB Authentication Bypass RCE Notes| CVE Name: CVE-2017-12635 VENDOR: http://couchdb.apache.org/ Notes: 12/8/2017 Windows 10 / CouchDB 2.0.0 - Exploit created Ubuntu 14.04 / CouchDB 1.5.0 - Exploit created...

Immunity Canvas: JBOSSMQ_HTTPIL_DESERIALIZATION

Name| jbossmqhttpildeserialization ---|--- CVE| CVE-2017-7504 Exploit Pack| CANVAS Description| jbossjavadeserializationrce Notes| CVE Name: CVE-2017-7504 VENDOR: Red Hat NOTES: HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default i...

Immunity Canvas: SOLARIS_RPC_LIBNSL

Name| solarisrpclibnsl ---|--- CVE| CVE-2017-3623 Exploit Pack| CANVAS Description| Solaris libnsl RPC - Remote Heap Overflow Notes| References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html CVE Name: CVE-2017-3623 VENDOR: Oracle Repeatability: Unlimited Date public:...

Immunity Canvas: MS15_102

Name| ms15102 ---|--- CVE| CVE-2015-2525 Exploit Pack| CANVAS Description| Windows Task Arbitrary File Deletion Notes| Repeatability: Infinite Notes: This module exploits a vulnerability on the Task Scheduler Service schedsvc.dll. When a scheduled task is created with the DeleteExpiredTaskAfter...

Immunity Canvas: BRIGHTMAIL_RESTORE

Name| brightmailrestore ---|--- CVE| CVE-2017-6327 Exploit Pack| CANVAS Description| Symantec Brightmail Pre-Auth Command Injection Notes| CVE Name: CVE-2017-6327 VENDOR: http://symantec.com Notes: Tested on: Symantec Messaging Gateway 10.6.3 Appliance SPECIAL: on SMG versions = 10.6.3, our...

Immunity Canvas: RAILS_ACTIONPACK_RENDER

Name| railsactionpackrender ---|--- CVE| CVE-2016-2098 Exploit Pack| CANVAS Description| railsactionpackrender Notes| CVE Name: CVE-2016-2098 VENDOR: http://rubyonrails.org Notes: This vulnerability affects ActionPack gem and it allows remote attackers to execute arbitrary Ruby Code due to the...

Immunity Canvas: MS15_100

Name| ms15100 ---|--- CVE| CVE-2015-2509 Exploit Pack| CANVAS Description| ms15100 Notes| References: https://technet.microsoft.com/library/security/ms15-100 CVE Name: CVE-2015-2509 VENDOR: Microsoft NOTES: Tested on: Windows 7 SP132 bits Windows 7 SP164 bits Use port 80 as the server port Window...

Immunity Canvas: LINUX_SCREEN

Name| linuxscreen ---|--- CVE| CVE-2017-5618 Exploit Pack| CANVAS Description| GNU Screen v4.5.0 local privilege escalation Notes| CVE Name: CVE-2017-5618 VENDOR: GNU Notes: Tested on: Ubuntu 16.10 x64 Ubuntu 16.04 LTS x64 Ubuntu 14.10 LTS x64 Ubuntu 14.04 LTS x32 Repeatability: Infinite...

Immunity Canvas: MAGENTO_SET_PAYMENT_INFO

Name| magentosetpaymentinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

Immunity Canvas: CISCO_SNMP_OID

Name| ciscosnmpoid ---|--- CVE| CVE-2016-6366 Exploit Pack| CANVAS Description| CISCO SNMP OID mem corruption Notes| Repeatability: Multiple Times Notes: python exploits/remote/cisco/ciscosnmpoid/ciscosnmpoid.py -t ip -p port -O community:community -O version:0/1 0 = disable password auth 1 =...

Immunity Canvas: JENKINS_JRMP_DESERIALIZATION

Name| jenkinsjrmpdeserialization ---|--- CVE| CVE-2016-0788 Exploit Pack| CANVAS Description| jenkinsjrmpdeserialization Notes| CVE Name: CVE-2016-0788 VENDOR: Jenkins NOTES: Versions tested: Ubuntu Linux 14.04.3 Jenkins 1.598 - 6 / 7 / 8 Jenkins 1.649 - 7 / 8 Windows 7 Ultimate SP1 Jenkins 1.598...

Immunity Canvas: WPUSERPRO_RCE

Name| wpuserprorce ---|--- CVE| CVE-2017-16562 Exploit Pack| CANVAS Description| Wordpress Remote Command Execution Through UserPro Plugin login bypass Notes| References: https://www.exploit-db.com/exploits/43117/ Repeatability: Infinite VENDOR: UserPro Plugin CVE Url:...

Immunity Canvas: MS16_111

Name| ms16111 ---|--- CVE| CVE-2016-3371 Exploit Pack| CANVAS Description| MS16-111 Registry Hive Hijack Notes| CVE Name: CVE-2016-3371 VENDOR: Microsoft Notes: Tested against: Windows 10 x64 EN both Chinese and English usernames - SUCCESSFUL EOP Windows XP x86 - EXECUTABLE DOES NOT RUN Windows 7...

Immunity Canvas: MAGENTO_SET_PAY_INFO

Name| magentosetpayinfo ---|--- CVE| CVE-2016-4010 Exploit Pack| CANVAS Description| Magento unauthenticated unserialize 2.0.6 Notes| Repeatability: Infinite VENDOR: Magento CVE Url: https://vulners.com/cve/CVE-2016-4010 CVE Name: CVE-2016-4010...

Immunity Canvas: EXIM_EXPANSION_RCE

Name| eximexpansionrce ---|--- CVE| CVE-2019-10149 Exploit Pack| CANVAS Description| eximexpansionrce Notes| CVE Name: CVE-2019-10149 VENDOR: Exim NOTES: A vulnerability exists in Exim since version 4.85 that allows for the execution of remote commands as the root user on a system. Current versio...