HTTP Fetch

Fetch and execute an x64 payload from an HTTP server. Module Options msf use payload/cmd/windows/http/x64/downloadexec msf payloaddownloadexec show actions ...actions... msf payloaddownloadexec set ACTION msf payloaddownloadexec show options ...show and set options... msf payloaddownloadexec run...

Service SystemD Persistence

This module will create a service on the box, and mark it for auto-restart. We need enough access to write service files and potentially restart services Targets: CentOS 7 Debian = 7, = 15 Ubuntu = 15.04 Verified on Ubuntu 18.04.3 Module Options msf use exploit/linux/persistence/initsystemd msf...

ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection

ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient validation of user input when performing the ChangePasswordAction function before passing it into a string that is later used as an OS command to execute. By making a POST reque...

runc (docker) File Descriptor Leak Privilege Escalation

All versions of runc use exploit/linux/local/runccwdprivesc msf exploitrunccwdprivesc show targets ...targets... msf exploitrunccwdprivesc set TARGET msf exploitrunccwdprivesc show options ...show and set options... msf exploitrunccwdprivesc exploit This module requires Metasploit:...

APISIX Admin API default access token RCE

Apache APISIX has a default, built-in API token edd1c9f034335f136f87ad84b625c8f1 that can be used to access all of the admin API, which leads to remote LUA code execution through the script parameter added in the 2.x version. This module also leverages another vulnerability to bypass the IP...

MongoDB Memory Disclosure (CVE-2025-14847) - Mongobleed

This module exploits a memory disclosure vulnerability in MongoDB's zlib decompression handling CVE-2025-14847. By sending crafted OPCOMPRESSED messages with inflated BSON document lengths, the server reads beyond the decompressed buffer and returns leaked memory contents in error messages. The...

Windows Cloud File Mini Filer Driver Heap Overflow

This module exploits the Windows Cloud Files Mini FIlter Driver cldflt.sys on Windows workstation versions 101809 through 1123H2 and Windows server versions 2022 to 2223H2. Module Options msf use exploit/windows/local/cve202430085cloudfiles msf exploitcve202430085cloudfiles show targets...

Ivanti Connect Secure Authenticated Remote Code Execution via OpenSSL CRLF Injection

This module exploits a CRLF injection vulnerability in Ivanti Connect Secure to achieve remote code execution CVE-2024-37404. Versions prior to 22.7R2.1 are vulnerable. Note that Ivanti Policy Secure versions prior to 22.7R1.1 are also vulnerable but this module doesn't support this software. Val...

Craft CMS Image Transform Preauth RCE (CVE-2025-32432)

This module exploits an unauthenticated remote code execution vulnerability in Craft CMS versions 3.x, 4.x, and 5.x use exploit/linux/http/craftcmspreauthrcecve202532432 msf exploitcraftcmspreauthrcecve202532432 show targets ...targets... msf exploitcraftcmspreauthrcecve202532432 set TARGET msf...

JetBrains TeamCity Unauthenticated Remote Code Execution

This module exploits an authentication bypass vulnerability in JetBrains TeamCity. An unauthenticated attacker can leverage this to access the REST API and create a new administrator access token. This token can be used to upload a plugin which contains a Metasploit payload, allowing the attacker...

Kafka UI Unauthenticated Remote Command Execution via the Groovy Filter option.

A command injection vulnerability exists in Kafka ui between v0.4.0 and v0.7.1 allowing an attacker to inject and execute arbitrary shell commands via the groovy filter parameter at the topic section. Module Options msf use exploit/linux/http/kafkauiunauthrcecve202352251 msf...

CVE-2025-33053 Exploit via Malicious .URL File and WebDAV

This module exploits CVE-2025-33053 by generating a malicious .URL file pointing to a trusted LOLBAS binary with parameters designed to trigger unintended behavior. Optionally, a payload is generated and hosted on a specified WebDAV directory. When the victim opens the shortcut, it will attempt t...

Linux eBPF ALU32 32-bit Invalid Bounds Tracking LPE

Linux kernels from 5.7-rc1 prior to 5.13-rc4, 5.12.4, 5.11.21, and 5.10.37 are vulnerable to a bug in the eBPF verifier's verification of ALU32 operations in the scalar32minmaxand function when performing AND operations, whereby under certain conditions the bounds of a 32 bit register would not b...

Windows Persistent Task Scheduler

This module establishes persistence by creating a scheduled task to run a payload. Module Options msf use exploit/windows/persistence/taskscheduler msf exploittaskscheduler show targets ...targets... msf exploittaskscheduler set TARGET msf exploittaskscheduler show options ...show and set...

GL.iNet Unauthenticated Remote Command Execution via the logread module.

A command injection vulnerability exists in multiple GL.iNet network products, allowing an attacker to inject and execute arbitrary shell commands via JSON parameters at the glsystemlog and glcrashlog interface in the logread module. This exploit requires post-authentication using the Admin-Token...

Pandora ITSM authenticated command injection leading to RCE via the backup function

Pandora ITSM is a platform for Service Management & Support including a Helpdesk for support and customer service teams, aligned with ITIL processes. This module exploits a command injection vulnerability in the name backup setting at the application setup page of Pandora ITSM. This can be...

Pretalx Limited File Write to Remote Code Execution

This module exploits CVE-2023-28458, a limited file write in Pretalx, up to version 2.3.1. The module will use the vulnerability to write a malicious site-specific configuration hook forPython. Once hook is written, payload will be executed every time Pretalx user runs any Python code. Pretalx...

LDAP Login Scanner

This module attempts to login to the LDAP service. Module Options msf use auxiliary/scanner/ldap/ldaplogin msf auxiliaryldaplogin show actions ...actions... msf auxiliaryldaplogin set ACTION msf auxiliaryldaplogin show options ...show and set options... msf auxiliaryldaplogin run This module...

SpecialFolderDatablock - Windows LNK File Special UNC Path NTLM Leak

This module creates a malicious Windows shortcut LNK file that specifies a special UNC path in SpecialFolderDatablock of Shell Link .LNK that can trigger an authentication attempt to a remote server. This can be used to harvest NTLM authentication credentials. When a victim browse to the location...

OSX Meterpreter, Reverse TCP Stager

Inject the mettle server payload staged. Connect back to the attacker Module Options msf use payload/osx/aarch64/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set options... msf...

Cisco IOX XE unauthenticated Command Line Interface (CLI) execution

This module leverages CVE-2023-20198 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary CLI commands with privilege level 15. You must specify the IOS command mode to execute a CLI command in. Valid modes are user, privileged, and...

Froxlor Log Path RCE

Froxlor v2.0.7 and below suffer from a bug that allows authenticated users to change the application logs path to any directory on the OS level which the user www-data can write without restrictions from the backend which leads to writing a malicious Twig template that the application will render...

Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution

This module exploits CVE-2025-34510, path traversal leading to remote code execution. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold. Module Options msf use exploit/windows/http/sitecorexpcve202534510 msf exploitsitecorexpcve202534510 sho...

Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)

This module exploits an unauthenticated remote command injection vulnerability in the Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02. The vulnerability lies in the 'time' parameter of the time configuration endpoint, which is passed unsanitized to a shell command executed via the date -s...

Roundcube Post-Auth RCE via PHP Object Deserialization

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. An attacker can execute arbitrary system commands as the...

TAR Path Traversal in Zimbra (CVE-2022-41352)

This module creates a .tar file that can be emailed to a Zimbra server to exploit CVE-2022-41352. If successful, it plants a JSP-based backdoor in the public web directory, then executes that backdoor. The core vulnerability is a path-traversal issue in the cpio command- line utlity that can...

IconEnvironmentDataBlock - Windows LNK File Special UNC Path NTLM Leak

This module creates a malicious Windows shortcut LNK file that specifies a special UNC path in IconEnvironmentDataBlock of Shell Link .LNK that can trigger an authentication attempt to a remote server. This can be used to harvest NTLM authentication credentials. When a victim browse to the locati...

Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability

A Remote Code Execution vulnerability in Gambio online webshop version 4.9.2.0 and lower allows remote attackers to run arbitrary commands via unauthenticated HTTP POST request. The identified vulnerability within Gambio pertains to an insecure deserialization flaw, which ultimately allows an...

Cisco IOX XE unauthenticated OS command execution

This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary OS commands with root privileges. This module leverages CVE-2023-20198 to create a new admin user, then authenticating...

OS Command Exec, Unix Command Shell, Reverse TCP (via netcat)

Execute an OS command from PHP. Creates an interactive shell via netcat Module Options msf use payload/php/unix/cmd/reversenetcat msf payloadreversenetcat show actions ...actions... msf payloadreversenetcat set ACTION msf payloadreversenetcat show options ...show and set options... msf...

CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)

This combination of an Arbitrary File Read CVE-2024-34102 and a Buffer Overflow in glibc CVE-2024-2961 allows for unauthenticated Remote Code Execution on the following versions of Magento and Adobe Commerce and earlier if the PHP and glibc versions are also vulnerable: - 2.4.7 and earlier -...

PyTorch Model Server Registration and Deserialization RCE

The PyTorch model server contains multiple vulnerabilities that can be chained together to permit an unauthenticated remote attacker arbitrary Java code execution. The first vulnerability is that the management interface is bound to all IP addresses and not just the loop back interface as the...

InvoiceShelf unauthenticated PHP Deserialization Vulnerability

InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments, create professional invoices & estimates and is based on the PHP framework Laravel. InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct PHP...

SolarWinds Serv-U Unauthenticated Arbitrary File Read

This module exploits an unauthenticated file read vulnerability, due to directory traversal, affecting SolarWinds Serv-U FTP Server 15.4, Serv-U Gateway 15.4, and Serv-U MFT Server 15.4. All versions prior to the vendor supplied hotfix "15.4.2 Hotfix 2" version 15.4.2.157 are affected. Module...

OS Command Exec, Unix Command Shell, Bind TCP (via Ruby) IPv6

Execute an OS command from PHP. Continually listen for a connection and spawn a command shell via Ruby Module Options msf use payload/php/unix/cmd/bindrubyipv6 msf payloadbindrubyipv6 show actions ...actions... msf payloadbindrubyipv6 set ACTION msf payloadbindrubyipv6 show options ...show and se...

Yum Package Manager Persistence

This module will run a payload when the package manager is used. This module modifies a yum plugin to launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/ will show what plugins are currently enabled on the system. root persmissions are likely required. Verified on Centos 7.1...

PHP Exec, PHP Command Shell, Bind TCP (via PHP)

Execute a PHP payload as an OS command from a Posix-compatible shell. Listen for a connection and spawn a command shell via php Module Options msf use payload/cmd/unix/php/bindphp msf payloadbindphp show actions ...actions... msf payloadbindphp set ACTION msf payloadbindphp show options ...show a...

Netfilter x_tables Heap OOB Write Privilege Escalation

A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/xtables.c. This allows an attacker to gain privileges or cause a DoS via heap memory corruption through user name space. Kernels up to 5.11 including are vulnerable. More information about vulnerable...

Microsoft Exchange ProxyNotShell RCE

This module chains two vulnerabilities on Microsoft Exchange Server that, when combined, allow an authenticated attacker to interact with the Exchange Powershell backend CVE-2022-41040, where a deserialization flaw can be leveraged to obtain code execution CVE-2022-41082. This exploit only suppor...

Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell. Module Options msf use payload/linux/riscv32le/shellreversetcp msf payloadshellreversetcp show actions ...actions... msf payloadshellreversetcp set ACTION msf payloadshellreversetcp show options ...show and set options... msf...

Listmonk Insecure Sprig Template Functions Environment Disclosure

This module exploits insecure Sprig template functions in Listmonk versions prior to v5.0.2. The env and expandenv functions are enabled by default, allowing authenticated users with campaign permissions to extract sensitive environment variables via campaign preview. Module Options msf use...

Maldoc in PDF Polyglot converter

A malicious MHT file created can be opened in Microsoft Word even though it has magic numbers and file structure of PDF. If the file has configured macro, by opening it in Microsoft Word, VBS runs and performs malicious behaviors. The attack does not bypass configured macro locks. And the malicio...

Windows Gather Mikrotik Winbox "Keep Password" Credentials Extractor

This module extracts Mikrotik Winbox credentials saved in the "settings.cfg.viw" file when the "Keep Password" option is selected in Winbox. Module Options msf use post/windows/gather/credentials/winboxsettings msf postwinboxsettings show actions ...actions... msf postwinboxsettings set ACTION ms...

Themebleed- Windows 11 Themes Arbitrary Code Execution CVE-2023-38146

When an unpatched Windows 11 host loads a theme file referencing an msstyles file, Windows loads the msstyles file, and if that file's PACKMEVERSION is 999, it then attempts to load an accompanying dll file ending in vrf.dll Before loading that file, it verifies that the file is signed. It does...

OS Command Exec, Unix Command Shell, Reverse TCP SSL (via python)

Execute an OS command from PHP. Creates an interactive shell via python, uses SSL, encodes with base64 by design. Module Options msf use payload/php/unix/cmd/reversepythonssl msf payloadreversepythonssl show actions ...actions... msf payloadreversepythonssl set ACTION msf payloadreversepythonssl...

Oracle Access Manager unauthenticated Remote Code Execution

This module exploits an unauthenticated deserialization of untrusted data vulnerability in the OpenSSO Agent component of the Oracle Access Manager OAM product. The affected product versions are 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0. Module Options msf use...

Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution

This module exploits an unauthenticated file write vulnerability in Cleo LexiCom, VLTrader, and Harmony versions 5.8.0.23 and below. Module Options msf use exploit/multi/http/cleorcecve202455956 msf exploitcleorcecve202455956 show targets ...targets... msf exploitcleorcecve202455956 set TARGET ms...

Malicious Windows Registration Entries (.reg) File

This module creates a Windows Registration Entries .reg file which adds the specified payload to the Windows Registry. The payload runs upon Windows login for the current user. If the user has elevated privileges when opening the file, the payload will run upon login when any user logs in. The us...

Malicious Windows Script Host Script File (.wsf)

This module creates a Windows Script Host WSH Windows Script File .wsf. Module Options msf use exploit/windows/fileformat/windowsscripthostwsf msf exploitwindowsscripthostwsf show targets ...targets... msf exploitwindowsscripthostwsf set TARGET msf exploitwindowsscripthostwsf show options ...show...

Apache Commons Text RCE

This exploit takes advantage of the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the "script", "dns" and "url" lookup keys...