Powershell Exec

Execute an x86 payload from a command via PowerShell Module Options msf use payload/cmd/windows/powershell/adduser msf payloadadduser show actions ...actions... msf payloadadduser set ACTION msf payloadadduser show options ...show and set options... msf payloadadduser run This module requires...

ICQ Credential Gatherer

This module searches for ICQ credentials on a Windows host. Module Options msf use post/windows/gather/credentials/icq msf posticq show actions ...actions... msf posticq set ACTION msf posticq show options ...show and set options... msf posticq run This module requires Metasploit:...

NetMotion Mobility Server MvcUtil Java Deserialization

This module exploits an unauthenticated Java deserialization in the NetMotion Mobility server's MvcUtil.valueStringToObject method, as invoked through the /mobility/Menu/isLoggedOn endpoint, to execute code as the SYSTEM account. Mobility server versions 11.x before 11.73 and 12.x before 12.02 ar...

WordPress Google Maps Plugin SQL Injection

This module exploits a SQL injection vulnerability in a REST endpoint registered by the WordPress plugin wp-google-maps between 7.11.00 and 7.11.17 included. As the table prefix can be changed by administrators, set DBPREFIX accordingly. Module Options msf use auxiliary/admin/http/wp/googlemapssq...

Pimcore Unserialize RCE

This module exploits a PHP unserialize in Pimcore before 5.7.1 to execute arbitrary code. An authenticated user with "classes" permission could exploit the vulnerability. The vulnerability exists in the "ClassController.php" class, where the "bulk-commit" method makes it possible to exploit the...

Nuuo Central Management Server User Session Token Bruteforce

Nuuo Central Management Server below version 2.4 has a flaw where it sends the heap address of the user object instead of a real session number when a user logs in. This can be used to reduce the keyspace for the session number from 10 million to 1.2 million, and with a bit of analysis it can be...

Nuuo Central Management Server Authenticated Arbitrary File Download

The Nuuo Central Management Server allows an authenticated user to download files from the installation folder. This functionality can be abused to obtain administrative credentials, the SQL Server database password and arbitrary files off the system with directory traversal. The module will...

MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection

This module exploits a universal cross-site scripting UXSS vulnerability found in Internet Explorer 10 and 11. By default, you will steal the cookie from TARGETURI which cannot have X-Frame-Options or it will fail. You can also have your own custom JavaScript by setting the CUSTOMJS option. Lastl...

MS15-001 Microsoft Windows NtApphelpCacheControl Improper Authorization Check

On Windows, the system call NtApphelpCacheControl the code is actually in ahcache.sys allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to...

NTP Mode 6 REQ_NONCE DRDoS Scanner

This module identifies NTP servers which permit mode 6 REQNONCE requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to REQNONCE requests with a response larger than the request, allowing remote attackers to cause a distributed, reflected denial of...

HP System Management Homepage JustGetSNMPQueue Command Injection

This module exploits a vulnerability found in HP System Management Homepage. By supplying a specially crafted HTTP request, it is possible to control the 'tempfilename' variable in function JustGetSNMPQueue found in ginkgosnmp.inc, which will be used in a exec function. Module Options msf use...

Apache Struts ParametersInterceptor Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/codeexecparameters msf undefinedcodeexecparameters show actions ...actions... msf undefinedcodeexecparameters set ACTION msf undefinedcodeexecparameters show options ...show and s...

Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow

This module exploits a buffer overflow in Apple QuickTime 7.6.6. When processing a malformed SMIL uri, a stack-based buffer overflow can occur when logging an error message. Module Options msf use exploit/windows/browser/apple/quicktimesmildebug msf undefinedquicktimesmildebug show actions...

Google Appliance ProxyStyleSheet Command Execution

This module exploits a feature in the Saxon XSLT parser used by the Google Search Appliance. This feature allows for arbitrary java methods to be called. Google released a patch and advisory to their client base in August of 2005 GA-2005-08-m. The target appliance must be able to connect back to...

Powershell Exec, Bind IPv6 TCP Stager (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for an IPv6 connection Windows x86 Module Options msf use payload/cmd/windows/powershell/patchupmeterpreter/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show...

Powershell Exec, Bind TCP Stager with UUID Support (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for a connection with UUID Support Windows x86 Module Options msf use payload/cmd/windows/powershell/patchupdllinject/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set ACTION msf payloadbindtcpuuid...

Powershell Exec, Windows x64 Reverse TCP Stager

Execute an x64 payload from a command via PowerShell. Connect back to the attacker Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options...

Mida Solutions eFramework ajaxreq.php Command Injection

This module exploits a command injection vulnerability in Mida Solutions eFramework version 2.9.0 and prior. The ajaxreq.php file allows unauthenticated users to inject arbitrary commands in the PARAM parameter to be executed as the apache user. The sudo configuration permits the apache user to...

Xymon Daemon Gather Information

This module retrieves information from a Xymon daemon service formerly Hobbit, based on Big Brother, including server configuration information, a list of monitored hosts, and associated client log for each host. This module also retrieves usernames and password hashes from the xymonpasswd config...

GetSimpleCMS Unauthenticated RCE

This module exploits a vulnerability found in GetSimpleCMS, which allows unauthenticated attackers to perform Remote Code Execution. An arbitrary file upload PHPcode for example vulnerability can be triggered by an authenticated user, however authentication can be bypassed by leaking the cms API...

Ulterius Server File Download Vulnerability

This module exploits a directory traversal vulnerability in Ulterius Server 'Ulterius Server File Download Vulnerability', 'Description' = %q This module exploits a directory traversal vulnerability in Ulterius Server 'Rick Osgood', Vulnerability discovery and PoC 'Jacob Robles' Metasploit module...

Joomla com_contenthistory Error-Based SQL Injection

This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 in order to either enumerate usernames and password hashes. Module Options msf use auxiliary/gather/joomla/contenthistorysqli msf undefinedcontenthistorysqli show actions ...actions... msf...

HP SiteScope issueSiebelCmd Remote Code Execution

This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the APISiteScopeImpl web service, specifically in the issueSiebelCmd method, which allows the user to execute arbitrary commands without authentication. This module has been tested successfully on HP SiteScope...

Script Web Delivery

This module quickly fires up a web server that serves a payload. The module will provide a command to be run on the target machine based on the selected target. The provided command will download and execute a payload using either a specified scripting language interpreter or "squiblydoo" via...

Java CMM Remote Code Execution

This module abuses the Color Management classes from a Java Applet to run arbitrary Java code outside of the sandbox as exploited in the wild in February and March of 2013. The vulnerability affects Java version 7u15 and earlier and 6u41 and earlier and has been tested successfully on Windows XP...

SVN wc.db Scanner

Scan for servers that allow access to the SVN wc.db file. Based on the work by Tim Meddin. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SVN wc.db Scanner', 'Description' = %q Scan for server...

Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability

This module exploits a default misconfiguration flaw on Symantec Messaging Gateway. The 'support' user has a known default password, which can be used to login to the SSH service, and gain privileged access from remote. Module Options msf use exploit/linux/ssh/symantec/smgssh msf undefinedsmgssh...

MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution

This module exploits a vulnerability found in SharePoint Server 2007 SP2. The software contains a directory traversal, that allows a remote attacker to write arbitrary files to the filesystem, sending a specially crafted SOAP ConvertFile request to the Office Document Conversions Launcher Service...

ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. Module Options msf use...

MS03-026 Microsoft RPC DCOM Interface Overflow

This module exploits a stack buffer overflow in the RPCSS service, this vulnerability was originally found by the Last Stage of Delirium research group and has been widely exploited ever since. This module can exploit the English versions of Windows NT 4.0 SP3-6a, Windows 2000, Windows XP, and...

FTP Fetch, Bind IPv6 TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for an IPv6 connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

Powershell Exec, Bind IPv6 TCP Stager (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for an IPv6 connection Windows x86 Module Options msf use payload/cmd/windows/powershell/peinject/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show options ...sho...

Powershell Exec, Windows x64 Reverse TCP Stager

Execute an x64 payload from a command via PowerShell. Connect back to the attacker Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/vncinject/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...sho...

Powershell Exec, Bind TCP Stager (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for a connection Windows x86 Module Options msf use payload/cmd/windows/powershell/patchupdllinject/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show and set...

Powershell Exec

Execute an x86 payload from a command via PowerShell Module Options msf use payload/cmd/windows/powershell/powershellreversetcpssl msf payloadpowershellreversetcpssl show actions ...actions... msf payloadpowershellreversetcpssl set ACTION msf payloadpowershellreversetcpssl show options ...show an...

Powershell Exec, Bind IPv6 TCP Stager with UUID Support (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for an IPv6 connection with UUID Support Windows x86 Module Options msf use payload/cmd/windows/powershell/peinject/bindipv6tcpuuid msf payloadbindipv6tcpuuid show actions ...actions... msf payloadbindipv6tcpuuid set ACTION msf...

Powershell Exec, Windows x64 Reverse HTTPS Stager (winhttp)

Execute an x64 payload from a command via PowerShell. Tunnel communication over HTTPS Windows x64 winhttp Module Options msf use payload/cmd/windows/powershell/x64/vncinject/reversewinhttps msf payloadreversewinhttps show actions ...actions... msf payloadreversewinhttps set ACTION msf...

Srware Credential Gatherer

This module searches for Srware credentials on a Windows host. SRWare Iron is a Chromium-based web browser developed by the German company SRWare. Module Options msf use post/windows/gather/credentials/srware msf postsrware show actions ...actions... msf postsrware set ACTION msf postsrware show...

Sage X3 Administration Service Authentication Bypass Command Execution

This module leverages an authentication bypass exploit within Sage X3 AdxSrv's administration protocol to execute arbitrary commands as SYSTEM against a Sage X3 Server running an available AdxAdmin service. Module Options msf use exploit/windows/sage/x3/adxsrvauthbypasscmdexec msf...

Git Ignore Retriever

This module finds potentially sensitive items by finding .gitignore files. Module Options msf use post/osx/gather/gitignore msf postgitignore show actions ...actions... msf postgitignore set ACTION msf postgitignore show options ...show and set options... msf postgitignore run class...

GravCMS Remote Command Execution

This module exploits arbitrary config write/update vulnerability to achieve remote code execution. Unauthenticated users can execute a terminal command under the context of the web server user. Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify...

Oracle Weblogic Server Deserialization RCE - MarshalledObject

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object weblogic.corba.utils.MarshalledObject to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializemarshalledobject msf...

MVPower DVR Shell Unauthenticated Command Execution

This module exploits an unauthenticated remote command execution vulnerability in MVPower digital video recorders. The 'shell' file on the web interface executes arbitrary operating system commands in the query string. This module was tested successfully on a MVPower model TV-7104HE with firmware...

HybridAuth install.php PHP Code Execution

This module exploits a PHP code execution vulnerability in HybridAuth versions 2.0.9 to 2.2.2. The install file 'install.php' is not removed after installation allowing unauthenticated users to write PHP code to the application configuration file 'config.php'. Note: This exploit will overwrite th...

VICIdial Manager Send OS Command Injection

The file agc/managersend.php in the VICIdial web application uses unsanitized user input as part of a command that is executed using the PHP passthru function. A valid username, password and session are needed to access the injection point. Fortunately, VICIdial has two built-in accounts with...

Sophos Web Protection Appliance patience.cgi Directory Traversal

This module abuses a directory traversal in Sophos Web Protection Appliance, specifically on the /cgi-bin/patience.cgi component. This module has been tested successfully on the Sophos Web Virtual Appliance v3.7.0. Module Options msf use auxiliary/admin/http/sophos/wpatraversal msf...

IBM Rational ClearQuest CQOle Remote Code Execution

This module exploits a function prototype mismatch on the CQOle ActiveX control in IBM Rational ClearQuest use exploit/windows/browser/clear/questcqole msf undefinedquestcqole show actions ...actions... msf undefinedquestcqole set ACTION msf undefinedquestcqole show options ...show and set...

Cisco AnyConnect VPN Client ActiveX URL Property Download and Execute

This module exploits a vulnerability in the Cisco AnyConnect VPN client vpnweb.ocx ActiveX control. This control is typically used to install the VPN client. An attacker can set the 'url' property which is where the control tries to locate the files needed to install the client. The control tries...

MOXA Device Manager Tool 2.1 Buffer Overflow

This module exploits a stack buffer overflow in MOXA MDM Tool 2.1. When sending a specially crafted MDMGw MDM2Gateway response, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/scada/moxa/mdmtool msf undefinedmdmtool show actions ...actions... msf...

SMTP User Enumeration Utility

The SMTP service has two internal commands that allow the enumeration of users: VRFY confirming the names of valid users and EXPN which reveals the actual address of users aliases and lists of e-mail mailing lists. Through the implementation of these SMTP commands can reveal a list of valid users...