BSD Dump Password Hashes

Post module to dump the password hashes for all users on a BSD system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BSD Dump Password Hashes', 'Description' = %q Post module to dump the...

Onion Omega2 Login Brute-Force

OnionOS login scanner module for Onion Omega2 devices. Module Options msf use auxiliary/scanner/http/onion/omega2login msf undefinedomega2login show actions ...actions... msf undefinedomega2login set ACTION msf undefinedomega2login show options ...show and set options... msf undefinedomega2login ...

Gather Ticket Granting Service (TGS) tickets for User Service Principal Names (SPN)

This module will try to find Service Principal Names that are associated with normal user accounts. Since normal accounts' passwords tend to be shorter than machine accounts, and knowing that a TGS request will encrypt the ticket with the account the SPN is running under, this could be used for a...

MS13-096 Microsoft Tagged Image File Format (TIFF) Integer Overflow

This module exploits a vulnerability found in Microsoft's Tagged Image File Format. It was originally discovered in the wild, targeting Windows XP and Windows Server 2003 users running Microsoft Office, specifically in the Middle East and South Asia region. The flaw is due to a DWORD value...

Windows Manage Reflective DLL Injection Module

This module will inject a specified reflective DLL into the memory of a process, new or existing. If arguments are specified, they are passed to the DllMain entry point as the lpvReserved 3rd parameter. To read output from the injected process, set PID to zero and WAIT to non-zero. Make sure the...

Apple Safari file:// Arbitrary Code Execution

This module exploits a vulnerability found in Apple Safari on OS X platform. A policy issue in the handling of file:// URLs may allow arbitrary remote code execution under the context of the user. In order to trigger arbitrary remote code execution, the best way seems to be opening a share on the...

rlogin Authentication Scanner

This module will test an rlogin service on a range of machines and report successful logins. NOTE: This module requires access to bind to privileged ports below 1024. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

ColdFusion Server Check

This module attempts to exploit the directory traversal in the 'locale' attribute. According to the advisory the following versions are vulnerable: ColdFusion MX6 6.1 base patches, ColdFusion MX7 7,0,0,91690 base patches, ColdFusion MX8 8,0,1,195765 base patches, ColdFusion MX8 8,0,1,195765 with...

Symantec ConsoleUtilities ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Symantecs ConsoleUtilities. By sending an overly long string to the "BrowseAndSaveFile" method located in the AeXNSConsoleUtilities.dll 6.0.0.1846 Control, an attacker may be able to execute arbitrary code Module Options msf use...

McAfee Visual Trace ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX Control NeoTraceExplorer.dll 1.0.0.1. By sending an overly long string to the "TraceTarget" method, an attacker may be able to execute arbitrary code. Module Options msf use...

FTP Fetch, Generic x86 Debug Trap

Fetch and execute a x86 payload from an FTP server. Generate a debug trap in the target process Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

HTTP Fetch, Windows shellcode stage, Find Tag Ordinal Stager

Fetch and execute an x86 payload from an HTTP server. Custom shellcode stage. Use an established connection Module Options msf use payload/cmd/windows/http/x86/custom/findtag msf payloadfindtag show actions ...actions... msf payloadfindtag set ACTION msf payloadfindtag show options ...show and se...

Powershell Exec, Hidden Bind Ipknock TCP Stager

Execute an x86 payload from a command via PowerShell. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socke...

Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution

This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm. The getTopologyHistory RPC method method takes a single argument which is the name of a user which is concatenated into a string that is executed by bash. In order for the...

WebLogic Server Deserialization RCE - BadAttributeValueExpException

There exists a Java object deserialization vulnerability in multiple versions of WebLogic. Unauthenticated remote code execution can be achieved by sending a serialized BadAttributeValueExpException object over the T3 protocol to vulnerable WebLogic servers. Module Options msf use...

Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution

This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot CVE-2016-7552. The second is a cmdi flaw using the timezone...

Varnish Cache CLI File Read

This module attempts to read the first line of a file by abusing the error message when compiling a file with vcl.load. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/tcp/client' require...

Windows Gather Local SQL Server Hash Dump

This module extracts the usernames and password hashes from an MSSQL server and stores them as loot. It uses the same technique in mssqllocalauthbypass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

MS13-097 Registry Symlink IE Sandbox Escape

This module exploits a vulnerability in Internet Explorer Sandbox which allows to escape the Enhanced Protected Mode and execute code with Medium Integrity. The vulnerability exists in the IESetProtectedModeRegKeyOnly function from the ieframe.dll component, which can be abused to force medium...

MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability

This module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CButton object is freed, but a reference is kept and used again during a page reload, an invalid memory that's controllable is used, and allows arbitrary code execution under the...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow

This module exploits a heap overflow found in InduSoft Web Studio use exploit/windows/browser/indusoft/issymbolinternationalseparator msf undefinedissymbolinternationalseparator show actions ...actions... msf undefinedissymbolinternationalseparator set ACTION msf...

Multi Gather VirtualBox VM Enumeration

This module will attempt to enumerate any VirtualBox VMs on the target machine. Due to the nature of VirtualBox, this module can only enumerate VMs registered for the current user, therefore, this module needs to be invoked from a user context. This module requires Metasploit:...

HTTP Vuln Scanner

This module identifies common vulnerable files or cgis. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Vuln Scanner', 'Description' = %q This module identifies common vulnerable files or...

MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution

This bug is triggered when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window' JavaScript function. This exploit results in a call to an address lower than the heap. The javascript prompt places our shellcode near where the call operand points...

WordPress Total Upkeep Unauthenticated Backup Downloader

This module exploits an unauthenticated database backup vulnerability in WordPress plugin 'Boldgrid-Backup' also known as 'Total Upkeep' version use auxiliary/scanner/http/wp/totalupkeepdownloader msf undefinedtotalupkeepdownloader show actions ...actions... msf undefinedtotalupkeepdownloader set...

Directory Traversal in Spring Cloud Config Server

This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.2.x prior to 2.2.3 and 2.1.x prior to 2.1.9, and older unsupported versions. Spring Cloud Config listens by default on port 8888. Module Options msf use...

Moodle Admin Shell Upload

This module will generate a plugin which can receive a malicious payload request and upload it to a server running Moodle provided valid admin credentials are used. Then the payload is sent for execution, and the plugin uninstalled. You must have an admin account to exploit this vulnerability...

Navigate CMS Unauthenticated Remote Code Execution

This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 2.8 and prior, to bypass authentication. The module then uses a path traversal vulnerability in navigateupload.php that allows authenticated users to upload PHP files to arbitrary locations...

Netgear Unauthenticated SOAP Password Extractor

This module exploits an authentication bypass vulnerability in different Netgear devices. It allows to extract the password for the remote management interface. This module has been tested on a Netgear WNDR3700v4 - V1.0.1.42, but other devices are reported as vulnerable: NetGear WNDR3700v4 -...

Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal

This module abuses a directory traversal vulnerability in the urlredirect.cgi application accessible through the web interface of Supermicro Onboard IPMI controllers. The vulnerability is present due to a lack of sanitization of the urlname parameter. This allows an attacker with a valid, but not...

SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow

This module exploits a remote stack buffer overflow vulnerability in 3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9. This vulnerability affects versions 3.4 SP4 Patch 2 and earlier. Module Options msf use exploit/windows/scada/codesys/webserver msf undefinedwebserver...

FrontPage Server Extensions Anonymous Login Scanner

This module queries the FrontPage Server Extensions and determines whether anonymous access is allowed. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FrontPage Server Extensions Anonymous Log...

Typo3 sa-2009-002 File Disclosure

This module exploits a file disclosure vulnerability in the jumpUrl mechanism of Typo3. This flaw can be used to read any file that the web server user account has access to. Module Options msf use auxiliary/admin/http/typo3/sa2009002 msf undefinedsa2009002 show actions ...actions... msf...

Microsoft Azure Active Directory Login Enumeration

This module enumerates valid usernames and passwords against a Microsoft Azure Active Directory domain by utilizing a flaw in how SSO authenticates. Module Options msf use auxiliary/scanner/http/azureadlogin msf auxiliaryazureadlogin show actions ...actions... msf auxiliaryazureadlogin set ACTION...

Drupal RESTful Web Services unserialize() RCE

This module exploits a PHP unserialize vulnerability in Drupal RESTful Web Services by sending a crafted request to the /node REST endpoint. As per SA-CORE-2019-003, the initial remediation was to disable POST, PATCH, and PUT, but Ambionics discovered that GET was also vulnerable albeit cached...

PRTG Network Monitor Authenticated RCE

Notifications can be created by an authenticated user and can execute scripts when triggered. Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command allowing command execution under the context of privileged user. The module uses provided...

RealNetworks Realplayer QCP Parsing Heap Overflow

This module exploits a heap overflow in Realplayer when handling a .QCP file. The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is allocated on the heap and user-supplied data from the file is copied within a memory copy loop. This allows a remote attacker to execute...

RealPlayer rmoc3260.dll ActiveX Control Heap Corruption

This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control. By sending a specially crafted string to the 'Console' property in the rmoc3260.dll control, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/realplayer/console...

PHP Exec, PHP Command Shell, Bind TCP (via Perl)

Execute a PHP payload from a command. Listen for a connection and spawn a command shell via perl persistent Module Options msf use payload/cmd/unix/php/bindperl msf payloadbindperl show actions ...actions... msf payloadbindperl set ACTION msf payloadbindperl show options ...show and set options...

Powershell Exec, Reverse TCP Stager (No NX or Win7)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker No NX Module Options msf use payload/cmd/windows/powershell/patchupdllinject/reversenonxtcp msf payloadreversenonxtcp show actions ...actions... msf payloadreversenonxtcp set ACTION msf payloadreversenonxtcp show...

Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Execute an x86 payload from a command via PowerShell. Listen for a connection Module Options msf use payload/cmd/windows/powershell/vncinject/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...show and set options...

Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for a connection with UUID Support Windows x86 Module Options msf use payload/cmd/windows/powershell/patchupmeterpreter/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set ACTION msf payloadbindtcpuu...

Powershell Exec, Reverse Ordinal TCP Stager (No NX or Win7)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker Module Options msf use payload/cmd/windows/powershell/dllinject/reverseordtcp msf payloadreverseordtcp show actions ...actions... msf payloadreverseordtcp set ACTION msf payloadreverseordtcp show options ...show an...

Thunderbird Credential Gatherer

This module searches for Thunderbird credentials on a Windows host. Module Options msf use post/windows/gather/credentials/thunderbird msf postthunderbird show actions ...actions... msf postthunderbird set ACTION msf postthunderbird show options ...show and set options... msf postthunderbird run...

WordPress ChopSlider3 id SQLi Scanner

The iDangero.us Chop Slider 3 WordPress plugin version 3.4 and prior contains a blind SQL injection in the id parameter of the getscript/index.php page. The injection is passed through GET parameters, and thus must be encoded, and magicquotes is applied at the server. Module Options msf use...

WordPress wpDiscuz Unauthenticated File Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin versions = 7.0.0 and use exploit/unix/webapp/wp/wpdiscuzunauthenticatedfileupload msf undefinedwpdiscuzunauthenticatedfileupload show actions ...actions... msf undefinedwpdiscuzunauthenticatedfileupload set ACTION msf...

Serv-U FTP Server prepareinstallation Privilege Escalation

This module attempts to gain root privileges on systems running Serv-U FTP Server versions prior to 15.1.7. The Serv-U executable is setuid root, and uses ARGV0 in a call to system, without validation, when invoked with the -prepareinstallation flag, resulting in command execution with root...

Password Cracker: Windows

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from Windows systems. LANMAN is format 3000 in hashcat. NTLM is format 1000 in hashcat. MSCASH is format 1100 in hashcat. MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 ...

Windows unmarshal post exploitation

This module exploits a local privilege escalation bug which exists in Microsoft COM for Windows when it fails to properly handle serialized objects. Module Options msf use post/windows/escalate/unmarshal/cmdexec msf undefinedcmdexec show actions ...actions... msf undefinedcmdexec set ACTION msf...

Intel AMT Digest Authentication Bypass Scanner

This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest CVE-2017-5689. This service can be found on ports 16992, 16993 tls, 623, and 624 tls. Module Options msf use auxiliary/scanner/http/intel/amtdigestbypass msf...