7325 matches found
SMB Fetch, Windows x64 IPv6 Bind TCP Stager
Fetch and execute an x64 payload from an SMB server. Listen for an IPv6 connection Windows x64 Module Options msf use payload/cmd/windows/smb/x64/meterpreter/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show options ...show...
SMB Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (winhttp)
Fetch and execute an x64 payload from an SMB server. Custom shellcode stage. Tunnel communication over HTTP Windows x64 winhttp Module Options msf use payload/cmd/windows/smb/x64/custom/reversewinhttp msf payloadreversewinhttp show actions ...actions... msf payloadreversewinhttp set ACTION msf...
TFTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x64)
Fetch and execute an x64 payload from a TFTP server. Custom shellcode stage. Listen for a connection with UUID Support Windows x64 Module Options msf use payload/cmd/windows/tftp/x64/custom/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set ACTION msf...
TFTP Fetch, Reverse SCTP Stager
Fetch and execute an x64 payload from a TFTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/tftp/x64/meterpreter/reversesctp msf payloadreversesctp show actions ...actions... msf payloadreversesctp set ACTION msf payloadreversesctp show options ...show and set...
macOS Gatekeeper check bypass
This module exploits two CVEs that bypass Gatekeeper. For CVE-2021-30657, this module serves an OSX app as a zip that contains no Info.plist, which bypasses gatekeeper in macOS use exploit/osx/browser/osx/gatekeeperbypass msf undefinedgatekeeperbypass show actions ...actions... msf...
Unified Remote Auth Bypass to RCE
This module utilizes the Unified Remote remote control protocol to type out and deploy a payload. The remote control protocol can be configured to have no passwords, a group password, or individual user accounts. If the web page is accessible, the access control is set to no password for...
Linux Execute Command
Execute an arbitrary command. Module Options msf use payload/linux/loongarch64/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options ...show and set options... msf payloadexec run frozenstringliteral: true This module requires Metasploit:...
TFTP Fetch, Windows Meterpreter Shell, Bind TCP Inline (x64)
Fetch and execute an x64 payload from a TFTP server. Connect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options msf use payload/cmd/windows/tftp/x64/meterpreterbindtcp msf payloadmeterpreterbindtcp show actions ...actions... msf payloadmeterpreterbindtcp set...
HTTPS Fetch, Windows shellcode stage, Windows x64 Bind TCP Stager
Fetch and execute an x64 payload from an HTTPS server. Custom shellcode stage. Listen for a connection Windows x64 Module Options msf use payload/cmd/windows/https/x64/custom/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...sho...
HTTPS Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x64 payload from an HTTPS server. Connect back to the attacker Module Options msf use payload/cmd/windows/https/x64/peinject/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...show and set...
TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline
Fetch and execute an x64 payload from a TFTP server. Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: 'nmap -sS target -p-'. Module Options msf use payload/cmd/linux/tftp/x64/shellbindtcprandomport msf payloadshellbindtcprandomport show actio...
ManageEngine Desktop Central Java Deserialization
This module exploits a Java deserialization vulnerability in the getChartImage method from the FileStorage class within ManageEngine Desktop Central versions use exploit/windows/http/desktopcentral/deserialization msf undefineddeserialization show actions ...actions... msf undefineddeserializatio...
HTTP Fetch, Windows Upload/Execute, Find Tag Ordinal Stager
Fetch and execute an x86 payload from an HTTP server. Uploads an executable and runs it staged. Use an established connection Module Options msf use payload/cmd/windows/http/x86/upexec/findtag msf payloadfindtag show actions ...actions... msf payloadfindtag set ACTION msf payloadfindtag show...
HTTP Fetch, Windows x86 Bind Named Pipe Stager
Fetch and execute an x86 payload from an HTTP server. Listen for a pipe connection Windows x86 Module Options msf use payload/cmd/windows/http/x86/patchupdllinject/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe show...
SMB Fetch
Fetch and execute an x64 payload from an SMB server. Module Options msf use payload/cmd/windows/smb/x64/powershellreversetcp msf payloadpowershellreversetcp show actions ...actions... msf payloadpowershellreversetcp set ACTION msf payloadpowershellreversetcp show options ...show and set options...
SMB Fetch, Windows shellcode stage, Windows x64 Reverse TCP Stager
Fetch and execute an x64 payload from an SMB server. Custom shellcode stage. Connect back to the attacker Windows x64 Module Options msf use payload/cmd/windows/smb/x64/custom/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show...
HTTPS Fetch, Linux Command Shell, Reverse TCP Stager
Fetch and execute an x86 payload from an HTTPS server. Spawn a command shell staged. Connect back to the attacker Module Options msf use payload/cmd/linux/https/x86/shell/reversetcpuuid msf payloadreversetcpuuid show actions ...actions... msf payloadreversetcpuuid set ACTION msf...
HTTPS Fetch, Windows Meterpreter Shell, Reverse HTTP Inline (x64)
Fetch and execute an x64 payload from an HTTPS server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options msf use payload/cmd/windows/https/x64/meterpreterreversehttp msf payloadmeterpreterreversehttp show actions ...actions... msf...
Powershell Exec, Windows x64 Command Shell, Bind TCP Stager with UUID Support (Windows x64)
Execute an x64 payload from a command via PowerShell. Spawn a piped command shell Windows x64 staged. Listen for a connection with UUID Support Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/shell/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf...
Sophos UTM WebAdmin SID Command Injection
This module exploits an SID-based command injection in Sophos UTM's WebAdmin interface to execute shell commands as the root user. Module Options msf use exploit/linux/http/sophos/utmwebadminsidcmdinjection msf undefinedutmwebadminsidcmdinjection show actions ...actions... msf...
HTTPS Fetch, Windows x86 Bind Named Pipe Stager
Fetch and execute an x86 payload from an HTTPS server. Listen for a pipe connection Windows x86 Module Options msf use payload/cmd/windows/https/x86/vncinject/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe show option...
HTTP Fetch, Bind TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x86 payload from an HTTP server. Listen for a connection Module Options msf use payload/cmd/windows/http/x86/patchupmeterpreter/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...show and set...
HTTPS Fetch, Windows MessageBox
Fetch and execute an x86 payload from an HTTPS server. Spawns a dialog via MessageBox using a customizable title, text & icon Module Options msf use payload/cmd/windows/https/x86/messagebox msf payloadmessagebox show actions ...actions... msf payloadmessagebox set ACTION msf payloadmessagebox sho...
HTTPS Fetch, Windows x86 Bind Named Pipe Stager
Fetch and execute an x86 payload from an HTTPS server. Listen for a pipe connection Windows x86 Module Options msf use payload/cmd/windows/https/x86/patchupmeterpreter/bindnamedpipe msf payloadbindnamedpipe show actions ...actions... msf payloadbindnamedpipe set ACTION msf payloadbindnamedpipe sh...
HTTPS Fetch, Linux Command Shell, Bind TCP Inline (IPv6)
Fetch and execute an x86 payload from an HTTPS server. Listen for a connection over IPv6 and spawn a command shell Module Options msf use payload/cmd/linux/https/x86/shellbindipv6tcp msf payloadshellbindipv6tcp show actions ...actions... msf payloadshellbindipv6tcp set ACTION msf...
TFTP Fetch, Bind TCP Stager with UUID Support (Linux x86)
Fetch and execute a x86 payload from a TFTP server. Listen for a connection with UUID Support Linux x86 Module Options msf use payload/cmd/linux/tftp/x86/meterpreter/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set ACTION msf payloadbindtcpuuid show options...
TFTP Fetch, Windows x64 Bind TCP Stager
Fetch and execute an x64 payload from a TFTP server. Listen for a connection Windows x64 Module Options msf use payload/cmd/windows/tftp/x64/peinject/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show and set options... msf...
TFTP Fetch, Windows MessageBox x64
Fetch and execute an x64 payload from a TFTP server. Spawn a dialog via MessageBox using a customizable title, text & icon Module Options msf use payload/cmd/windows/tftp/x64/messagebox msf payloadmessagebox show actions ...actions... msf payloadmessagebox set ACTION msf payloadmessagebox show...
HTTPS Fetch, Linux x64 Pingback, Bind TCP Inline
Fetch and execute an x64 payload from an HTTPS server. Accept a connection from attacker and report UUID Linux x64 Module Options msf use payload/cmd/linux/https/x64/pingbackbindtcp msf payloadpingbackbindtcp show actions ...actions... msf payloadpingbackbindtcp set ACTION msf...
Zyxel Firewall SUID Binary Privilege Escalation
This module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user e.g. nobody escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an attacker...
DotCMS RCE via Arbitrary File Upload.
When files are uploaded into dotCMS via the content API, but before they become content, dotCMS writes the file down in a temp directory. In the case of this vulnerability, dotCMS does not sanitize the filename passed in via the multipart request header and thus does not sanitize the temp file's...
Microsoft SharePoint Unsafe Control and ViewState RCE
The EditingPageParser.VerifyControlOnSafeList method fails to properly validate user supplied data. This can be leveraged by an attacker to leak sensitive information in rendered-preview content. This module will leak the ViewState validation key and then use it to sign a crafted object that will...
EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution
This module exploits multiple vulnerabilities in EyesOfNetwork version 5.1, 5.2 and 5.3 in order to execute arbitrary commands as root. This module takes advantage of a command injection vulnerability in the target parameter of the AutoDiscovery functionality within the EON web interface in order...
HTTPS Fetch, Windows Upload/Execute, Bind TCP Stager (Windows x86)
Fetch and execute an x86 payload from an HTTPS server. Uploads an executable and runs it staged. Listen for a connection Windows x86 Module Options msf use payload/cmd/windows/https/x86/upexec/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp...
HTTPS Fetch, Windows Command Shell, Reverse TCP Stager
Fetch and execute an x86 payload from an HTTPS server. Spawn a piped command shell staged. Connect back to the attacker Module Options msf use payload/cmd/windows/https/x86/shell/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp sho...
HTTP Fetch, Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an HTTP server. Spawn a piped command shell staged. Connect back to the attacker Module Options msf use payload/cmd/windows/http/x86/shell/reverseordtcp msf payloadreverseordtcp show actions ...actions... msf payloadreverseordtcp set ACTION msf...
HTTPS Fetch, Bind TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an HTTPS server. Listen for a connection No NX Module Options msf use payload/cmd/windows/https/x86/patchupmeterpreter/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options ...show...
HTTPS Fetch, Generic x86 Debug Trap
Fetch and execute an x86 payload from an HTTPS server. Generate a debug trap in the target process Module Options msf use payload/cmd/windows/https/x86/generic/debugtrap msf payloaddebugtrap show actions ...actions... msf payloaddebugtrap set ACTION msf payloaddebugtrap show options ...show and s...
HTTP Fetch, Reverse TCP Stager
Fetch and execute an x86 payload from an HTTP server. Connect back to the attacker Module Options msf use payload/cmd/windows/http/x86/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set...
HTTP Fetch, Reverse TCP Stager
Fetch and execute an x86 payload from an HTTP server. Connect back to the attacker Module Options msf use payload/cmd/windows/http/x86/peinject/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set options...
SMB Fetch, Windows x64 Reverse HTTP Stager (wininet)
Fetch and execute an x64 payload from an SMB server. Tunnel communication over HTTP Windows x64 wininet Module Options msf use payload/cmd/windows/smb/x64/vncinject/reversehttp msf payloadreversehttp show actions ...actions... msf payloadreversehttp set ACTION msf payloadreversehttp show options...
SMB Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x64 payload from an SMB server. Custom shellcode stage. Connect back to the attacker Module Options msf use payload/cmd/windows/smb/x64/custom/reversetcprc4 msf payloadreversetcprc4 show actions ...actions... msf payloadreversetcprc4 set ACTION msf payloadreversetcprc4 show...
SMB Fetch, Windows x64 Reverse HTTP Stager (winhttp)
Fetch and execute an x64 payload from an SMB server. Tunnel communication over HTTP Windows x64 winhttp Module Options msf use payload/cmd/windows/smb/x64/meterpreter/reversewinhttp msf payloadreversewinhttp show actions ...actions... msf payloadreversewinhttp set ACTION msf payloadreversewinhttp...
TFTP Fetch, Linux Command Shell, Find Port Inline
Fetch and execute a x86 payload from a TFTP server. Spawn a shell on an established connection Module Options msf use payload/cmd/linux/tftp/x86/shellfindport msf payloadshellfindport show actions ...actions... msf payloadshellfindport set ACTION msf payloadshellfindport show options ...show and...
Command Shell, Reverse SCTP (via python)
Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+. Module Options msf use payload/python/shellreversesctp msf payloadshellreversesctp show actions ...actions... msf payloadshellreversesctp set ACTION msf payloadshellreversesctp show...
HTTP Fetch, Windows x64 Bind TCP Stager
Fetch and execute an x64 payload from an HTTP server. Listen for a connection Windows x64 Module Options msf use payload/cmd/windows/http/x64/meterpreter/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show and set options...
Powershell Exec, Windows Meterpreter Shell, Bind TCP Inline
Execute an x86 payload from a command via PowerShell. Connect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options msf use payload/cmd/windows/powershell/meterpreterbindtcp msf payloadmeterpreterbindtcp show actions ...actions... msf payloadmeterpreterbindtcp...
Wordpress Secure Copy Content Protection and Content Locking sccp_id Unauthenticated SQLi
Secure Copy Content Protection and Content Locking, a WordPress plugin, prior to 2.8.2 is affected by an unauthenticated SQL injection via the sccpid parameter. Remote attackers can exploit this vulnerability to dump usernames and password hashes from thewpusers table of the affected WordPress...
Jupyter Login Utility
This module checks if authentication is required on a Jupyter Lab or Notebook server. If it is, this module will bruteforce the password. Jupyter only requires a password to authenticate, usernames are not used. This module is compatible with versions 4.3.0 released 2016-12-08 and newer. Module...
Nagios XI Enumeration
NagiosXI may store credentials of the hosts it monitors. This module extracts these credentials, creating opportunities for lateral movement. Module Options msf use post/linux/gather/enum/nagiosxi msf undefinednagiosxi show actions ...actions... msf undefinednagiosxi set ACTION msf...