7342 matches found
SMB Fetch, Windows x64 Command Shell, Windows x64 Bind Named Pipe Stager
Fetch and execute an x64 payload from an SMB server. Spawn a piped command shell Windows x64 staged. Listen for a pipe connection Windows x64 Module Options msf use payload/cmd/windows/smb/x64/shell/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set...
Find Users Without Pre-Auth Required (ASREP-roast)
This module searches for AD users without pre-auth required. Two different approaches are provided: - Brute force of usernames does not require a user account; should not lock out accounts - LDAP lookup requires an AD user account Module Options msf use auxiliary/gather/asrep msf auxiliaryasrep...
HTTPS Fetch, Reverse TCP Stager (IPv6)
Fetch and execute an x86 payload from an HTTPS server. Connect back to attacker over IPv6 Module Options msf use payload/cmd/linux/https/x86/meterpreter/reverseipv6tcp msf payloadreverseipv6tcp show actions ...actions... msf payloadreverseipv6tcp set ACTION msf payloadreverseipv6tcp show options...
HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)
Fetch and execute an x86 payload from an HTTPS server. Spawn a command shell staged. Listen for an IPv6 connection Linux x86 Module Options msf use payload/cmd/linux/https/x86/shell/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf...
HTTP Fetch, Linux Command Shell, Reverse TCP Stager
Fetch and execute a x86 payload from an HTTP server. Spawn a command shell staged. Connect back to the attacker Module Options msf use payload/cmd/linux/http/x86/shell/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options...
HTTPS Fetch, Windows x64 Reverse HTTP Stager (wininet)
Fetch and execute an x64 payload from an HTTPS server. Tunnel communication over HTTP Windows x64 wininet Module Options msf use payload/cmd/windows/https/x64/meterpreter/reversehttps msf payloadreversehttps show actions ...actions... msf payloadreversehttps set ACTION msf payloadreversehttps sho...
SolarWinds Information Service (SWIS) .NET Deserialization From AMQP RCE
The SolarWinds Information Service SWIS is vulnerable to RCE by way of a crafted message received through the AMQP message queue. A malicious user that can authenticate to the AMQP service can publish such a crafted message whose body is a serialized .NET object which can lead to OS command...
Sourcegraph gitserver sshCommand RCE
A vulnerability exists within Sourcegraph's gitserver component that allows a remote attacker to execute arbitrary OS commands by modifying the core.sshCommand value within the git configuration. This command can then be triggered on demand by executing a git push operation. The vulnerability was...
Microsoft IIS FTP Server LIST Stack Exhaustion
This module triggers Denial of Service condition in the Microsoft Internet Information Services IIS FTP Server 5.0 through 7.0 via a list ls -R command containing a wildcard. For this exploit to work in most cases, you need 1 a valid ftp account: either read-only or write-access account 2 the "FT...
HTTPS Fetch, Bind TCP Stager (Windows x86)
Fetch and execute an x86 payload from an HTTPS server. Listen for a connection Windows x86 Module Options msf use payload/cmd/windows/https/x86/peinject/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show and set options... m...
HTTPS Fetch, Windows shellcode stage, Hidden Bind Ipknock TCP Stager
Fetch and execute an x86 payload from an HTTPS server. Custom shellcode stage. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellco...
FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass
This module exploits an unauthenticated remote code execution vulnerability in FreeScout use exploit/multi/http/freescout/htaccessrce msf undefinedhtaccessrce show actions ...actions... msf undefinedhtaccessrce set ACTION msf undefinedhtaccessrce show options ...show and set options... msf...
TFTP Fetch, Linux Add User
Fetch and execute a x86 payload from a TFTP server. Create a new user with UID 0 Module Options msf use payload/cmd/linux/tftp/x86/adduser msf payloadadduser show actions ...actions... msf payloadadduser set ACTION msf payloadadduser show options ...show and set options... msf payloadadduser run...
TFTP Fetch, Windows x64 Reverse HTTPS Stager (winhttp)
Fetch and execute an x64 payload from a TFTP server. Tunnel communication over HTTPS Windows x64 winhttp Module Options msf use payload/cmd/windows/tftp/x64/vncinject/reversewinhttps msf payloadreversewinhttps show actions ...actions... msf payloadreversewinhttps set ACTION msf...
HTTPS Fetch, Linux Execute Command
Fetch and execute an x64 payload from an HTTPS server. Execute an arbitrary command or just a /bin/sh shell Module Options msf use payload/cmd/linux/https/x64/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options ...show and set options... msf...
TFTP Fetch, Linux Command Shell, Bind TCP Stager
Fetch and execute an x64 payload from a TFTP server. Spawn a command shell staged. Listen for a connection Module Options msf use payload/cmd/linux/tftp/x64/shell/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show and set...
Modbus Banner Grabbing
This module grabs the banner of any device running the Modbus protocol by sending a request with Modbus Function Code 43 Read Device Identification. Modbus is a data communications protocol originally published by Modicon now Schneider Electric in 1979 for use with its programmable logic...
VMWare Authentication Daemon Version Scanner
This module will identify information about a host through the vmauthd service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Authentication Daemon Version Scanner', 'Description' = %q...
TFTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager with UUID Support (Linux x86)
Fetch and execute a x86 payload from a TFTP server. Spawn a command shell staged. Listen for an IPv6 connection with UUID Support Linux x86 Module Options msf use payload/cmd/linux/tftp/x86/shell/bindipv6tcpuuid msf payloadbindipv6tcpuuid show actions ...actions... msf payloadbindipv6tcpuuid set...
TFTP Fetch, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)
Fetch and execute an x64 payload from a TFTP server. Spawn a piped command shell Windows x64 staged. Listen for a connection with UUID Support Windows x64 Module Options msf use payload/cmd/windows/tftp/x64/shell/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid...
HTTPS Fetch, Windows x64 Reverse TCP Stager
Fetch and execute an x64 payload from an HTTPS server. Connect back to the attacker Windows x64 Module Options msf use payload/cmd/windows/https/x64/peinject/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and...
HTTPS Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager
Fetch and execute an x64 payload from an HTTPS server. Spawn a piped command shell Windows x64 staged. Listen for a connection Windows x64 Module Options msf use payload/cmd/windows/https/x64/shell/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf...
HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager with UUID Support
Fetch and execute an x64 payload from an HTTPS server. Listen for an IPv6 connection with UUID Support Windows x64 Module Options msf use payload/cmd/windows/https/x64/meterpreter/bindipv6tcpuuid msf payloadbindipv6tcpuuid show actions ...actions... msf payloadbindipv6tcpuuid set ACTION msf...
HTTP Fetch, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)
Fetch and execute an x86 payload from an HTTP server. Uploads an executable and runs it staged. Listen for a connection with UUID Support Windows x86 Module Options msf use payload/cmd/windows/http/x86/upexec/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set...
HTTPS Fetch, Hidden Bind TCP Stager
Fetch and execute an x86 payload from an HTTPS server. Listen for a connection from a hidden port and spawn a command shell to the allowed host. Module Options msf use payload/cmd/windows/https/x86/meterpreter/bindhiddentcp msf payloadbindhiddentcp show actions ...actions... msf...
HTTP Fetch, Windows Command Shell, Reverse All-Port TCP Stager
Fetch and execute an x86 payload from an HTTP server. Spawn a piped command shell staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options msf use payload/cmd/windows/http/x86/shell/reversetcpallports msf payloadreversetcpallports show actions ...actions...
Next.js Middleware Authorization Bypass Scanner
This module detects self-hosted Next.js applications affected by CVE-2025-29927, an authorization bypass in the middleware layer. Next.js tags its own internal subrequests with the x-middleware-subrequest header and skips middleware when it sees it. The header is trusted without verifying it...
Python Exec, Python Execute Command
Execute a Python payload as an OS command from a Posix-compatible shell. Execute an arbitrary OS command. Compatible with Python 2.7 and 3.4+. Module Options msf use payload/cmd/unix/python/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options...
SMB Fetch, Windows x64 IPv6 Bind TCP Stager
Fetch and execute an x64 payload from an SMB server. Listen for an IPv6 connection Windows x64 Module Options msf use payload/cmd/windows/smb/x64/vncinject/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show options ...show a...
TFTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x64 payload from a TFTP server. Connect back to the attacker Module Options msf use payload/cmd/windows/tftp/x64/vncinject/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...show and set options...
TFTP Fetch, Windows x64 Reverse HTTP Stager (wininet)
Fetch and execute an x64 payload from a TFTP server. Tunnel communication over HTTP Windows x64 wininet Module Options msf use payload/cmd/windows/tftp/x64/meterpreter/reversehttp msf payloadreversehttp show actions ...actions... msf payloadreversehttp set ACTION msf payloadreversehttp show optio...
HTTPS Fetch, Windows x64 IPv6 Bind TCP Stager
Fetch and execute an x64 payload from an HTTPS server. Listen for an IPv6 connection Windows x64 Module Options msf use payload/cmd/windows/https/x64/peinject/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show options ...sho...
HTTPS Fetch, Linux Command Shell, Reverse TCP Stager
Fetch and execute an x64 payload from an HTTPS server. Spawn a command shell staged. Connect back to the attacker Module Options msf use payload/cmd/linux/https/x64/shell/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show option...
Safari Webkit JIT Exploit for iOS 7.1.2
This module exploits a JIT optimization bug in Safari Webkit. This allows us to write shellcode to an RWX memory section in JavaScriptCore and execute it. The shellcode contains a kernel exploit CVE-2016-4669 that obtains kernel rw, obtains root and disables code signing. Finally we download and...
Netcore Router Udp 53413 Backdoor
Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cyber criminals to easily run arbitrary co...
SMB to Meterpreter Upgrade via PsExec
Upgrades an authenticated SMB session to a Meterpreter session using PsExec techniques. This module uploads a service-wrapped executable payload to the ADMIN$ share via the existing authenticated SMB connection, then creates and starts a Windows service that executes the payload. This mirrors the...
HTTPS Fetch, Windows x86 Bind Named Pipe Stager
Fetch and execute an x86 payload from an HTTPS server. Listen for a pipe connection Windows x86 Module Options msf use payload/cmd/windows/https/x86/vncinject/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe show option...
HTTP Fetch, Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x86 payload from an HTTP server. Uploads an executable and runs it staged. Listen for a connection Module Options msf use payload/cmd/windows/http/x86/upexec/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 sho...
HTTPS Fetch, Windows x86 Bind Named Pipe Stager
Fetch and execute an x86 payload from an HTTPS server. Listen for a pipe connection Windows x86 Module Options msf use payload/cmd/windows/https/x86/patchupmeterpreter/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe sh...
HTTPS Fetch, Windows MessageBox
Fetch and execute an x86 payload from an HTTPS server. Spawns a dialog via MessageBox using a customizable title, text & icon Module Options msf use payload/cmd/windows/https/x86/messagebox msf payloadmessagebox show actions ...actions... msf payloadmessagebox set ACTION msf payloadmessagebox sho...
HTTP Fetch, Bind TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an HTTP server. Listen for a connection No NX Module Options msf use payload/cmd/windows/http/x86/patchupdllinject/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options ...show and...
Windows Registry Security Descriptor Utility
Read or write a Windows registry security descriptor remotely. In READ mode, the FILE option can be set to specify where the security descriptor should be written to. The following format is used: key: securityinfo: sd: In WRITE mode, the FILE option can be used to specify the information needed ...
SMB Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x64 payload from an SMB server. Connect back to the attacker Module Options msf use payload/cmd/windows/smb/x64/peinject/reversetcprc4 msf payloadreversetcprc4 show actions ...actions... msf payloadreversetcprc4 set ACTION msf payloadreversetcprc4 show options ...show and set...
SMB Fetch, Windows x64 Command Shell, Windows x64 IPv6 Bind TCP Stager
Fetch and execute an x64 payload from an SMB server. Spawn a piped command shell Windows x64 staged. Listen for an IPv6 connection Windows x64 Module Options msf use payload/cmd/windows/smb/x64/shell/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION m...
HTTP Fetch, Windows Meterpreter Shell, Reverse HTTPS Inline (x64)
Fetch and execute an x64 payload from an HTTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options msf use payload/cmd/windows/http/x64/meterpreterreversehttps msf payloadmeterpreterreversehttps show actions ...actions... msf...
RPyC 4.1.0 through 4.1.1 Remote Command Execution
This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1. You will be able to execute a specified command on the target machine as the user running the RPyC service and view the output. Module Options msf use auxiliary/scanner/http/rpyc/rce msf undefinedrce show actions...
Background Intelligent Transfer Service Arbitrary File Move Privilege Elevation Vulnerability
This module exploits CVE-2020-0787, an arbitrary file move vulnerability in outdated versions of the Background Intelligent Transfer Service BITS, to overwrite C:\Windows\System32\WindowsCoreDeviceInfo.dll with a malicious DLL containing the attacker's payload. To achieve code execution as the...
MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where primitive. This will then be used to overwrite the connection session information with as an Administrator session. From there, the normal psexec payload code execution is done. Exploits a type confusion...
Calibre Python Code Injection (CVE-2024-6782)
This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled disabled by default, it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any...
Ray static arbitrary file read
Ray before 2.8.1 is vulnerable to a local file inclusion. Module Options msf use auxiliary/gather/ray/lficve20236020 msf undefinedlficve20236020 show actions ...actions... msf undefinedlficve20236020 set ACTION msf undefinedlficve20236020 show options ...show and set options... msf...