VMware vCenter Server vmdir Authentication Bypass

This module bypasses LDAP authentication in VMware vCenter Server's vmdir service to add an arbitrary administrator user. Version 6.7 prior to the 6.7U3f update is vulnerable, only if upgraded from a previous release line, such as 6.0 or 6.5. Note that it is also possible to provide a bind userna...

Mac OS X Root Privilege Escalation

This module exploits a serious flaw in MacOSX High Sierra. Any user can login with user "root", leaving an empty password. Module Options msf use exploit/osx/local/root/nopassword msf undefinednopassword show actions ...actions... msf undefinednopassword set ACTION msf undefinednopassword show...

JVC/Siemens/Vanderbilt IP-Camera Readfile Password Disclosure

SIEMENS IP-Camera CVMS2025-IR + CCMS2025, JVC IP-Camera VN-T216VPRU, and Vanderbilt IP-Camera CCPW3025-IR + CVMW3025-IR allow an unauthenticated user to disclose the username & password by requesting the javascript page 'readfile.cgi?query=ADMINID'. Siemens firmwares affected: x.2.2.1798,...

SMB Group Policy Preference Saved Passwords Enumeration

This module enumerates files from target domain controllers and connects to them via SMB. It then looks for Group Policy Preference XML files containing local/domain user accounts and passwords and decrypts them using Microsoft's public AES key. This module has been tested successfully on a Win2k...

Seagate Business NAS Unauthenticated Remote Command Execution

Some Seagate Business NAS devices are vulnerable to command execution via a local file include vulnerability hidden in the language parameter of the CodeIgniter session cookie. The vulnerability manifests in the way the language files are included in the code on the login page, and hence is open ...

Windows Escalate Golden Ticket

This module will create a Golden Kerberos Ticket using the Mimikatz Kiwi Extension. If no options are applied it will attempt to identify the current domain, the domain administrator account, the target domain SID, and retrieve the krbtgt NTLM hash from the database. By default the well-known...

Apache Struts ClassLoader Manipulation Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts versions 1.x use exploit/multi/http/struts/codeexecclassloader msf undefinedcodeexecclassloader show actions ...actions... msf undefinedcodeexecclassloader set ACTION msf undefinedcodeexecclassloader show options ...sh...

WinRM Script Exec Remote Code Execution

This module uses valid credentials to login to the WinRM service and execute a payload. It has two available methods for payload delivery: Powershell 2 and above and VBS CmdStager. The module will check if Powershell is available, and if so uses that method. Otherwise it falls back to the VBS...

MS11-021 Microsoft Office 2007 Excel .xlb Buffer Overflow

This module exploits a vulnerability found in Excel of Microsoft Office 2007. By supplying a malformed .xlb file, an attacker can control the content source of a memcpy routine, and the number of bytes to copy, therefore causing a stack- based buffer overflow. This results in arbitrary code...

Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability

This module exploits a vulnerability in Adobe Flash Player that was discovered, and has been exploited actively in the wild. By embedding a specially crafted .swf file, Adobe Flash crashes due to an invalid use of an object type, which allows attackers to overwrite a pointer in memory, and result...

Adobe Flash Player "Button" Remote Code Execution

This module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially...

Iomega StorCenter Pro NAS Web Authentication Bypass

The Iomega StorCenter Pro Network Attached Storage device web interface increments sessions IDs, allowing for simple brute force attacks to bypass authentication and gain administrative access. This module requires Metasploit: https://metasploit.com/download Current source:...

Timbuktu Pro Directory Traversal/File Upload

This module exploits a directory traversal vulnerability in Motorola's Timbuktu Pro for Windows 8.6.5. Module Options msf use exploit/windows/motorola/timbuktu/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options...

Zinf Audio Player 2.2.1 (PLS File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in the Zinf Audio Player 2.2.1. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an embedded PLS file within a browser, when the PLS extension is registered ...

MS03-007 Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow

This exploits a buffer overflow in NTDLL.dll on Windows 2000 through the SEARCH WebDAV method in IIS. This particular module only works against Windows 2000. It should have a reasonable chance of success against SP0 to SP3. Module Options msf use exploit/windows/iis/ms03/007ntdllwebdav msf...

FTP Fetch, Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Connect back to the attacker No NX Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options...

FTP Fetch, Bind TCP Stager with UUID Support (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for a connection with UUID Support Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

Powershell Exec

Execute an x64 payload from a command via PowerShell Module Options msf use payload/cmd/windows/powershell/x64/powershellbindtcp msf payloadpowershellbindtcp show actions ...actions... msf payloadpowershellbindtcp set ACTION msf payloadpowershellbindtcp show options ...show and set options... msf...

Powershell Exec, Reverse TCP Stager with UUID Support

Execute an x86 payload from a command via PowerShell. Connect back to the attacker with UUID Support Module Options msf use payload/cmd/windows/powershell/vncinject/reversetcpuuid msf payloadreversetcpuuid show actions ...actions... msf payloadreversetcpuuid set ACTION msf payloadreversetcpuuid...

Powershell Exec, Reverse TCP Stager (IPv6)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker over IPv6 Module Options msf use payload/cmd/windows/powershell/dllinject/reverseipv6tcp msf payloadreverseipv6tcp show actions ...actions... msf payloadreverseipv6tcp set ACTION msf payloadreverseipv6tcp show...

Zahir Enterprise Plus 6 Stack Buffer Overflow

This module exploits a stack buffer overflow in Zahir Enterprise Plus version 6 build 10b and below. The vulnerability is triggered when opening a CSV file containing CR/LF and overly long string characters via Import from other File. This results in overwriting a structured exception handler...

Realtek SDK Miniigd UPnP SOAP Command Execution

Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested successfully on a Trendnet TEW-731BR...

Malicious Git and Mercurial HTTP Server For CVE-2014-9390

This module exploits CVE-2014-9390, which affects Git versions less than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1 and Mercurial versions less than 3.2.3 and describes three vulnerabilities. On operating systems which have case-insensitive file systems, like Windows and OS X, Git clients can be...

KingScada kxClientDownload.ocx ActiveX Remote Code Execution

This module abuses the kxClientDownload.ocx ActiveX control distributed with WellingTech KingScada. The ProjectURL property can be abused to download and load arbitrary DLLs from arbitrary locations, leading to arbitrary code execution, because of a dangerous usage of LoadLibrary. Due to the natu...

Java JMX Server Insecure Endpoint Code Execution Scanner

Detect Java JMX endpoints Module Options msf use auxiliary/scanner/misc/java/jmxserver msf undefinedjmxserver show actions ...actions... msf undefinedjmxserver set ACTION msf undefinedjmxserver show options ...show and set options... msf undefinedjmxserver run This module requires Metasploit:...

SAP SOAP Service RFC_PING Login Brute Forcer

This module attempts to brute force SAP username and passwords through the /sap/bc/soap/rfc SOAP service, using RFCPING function. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspired by, o...

Drupal OpenID External Entity Injection

This module abuses an XML External Entity Injection vulnerability on the OpenID module from Drupal. The vulnerability exists in the parsing of a malformed XRDS file coming from a malicious OpenID endpoint. This module has been tested successfully on Drupal 7.15 and 7.2 with the OpenID module...

Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)

This module exploits a stack buffer overflow in Lotus Notes 8.5.2 when parsing a malformed, specially crafted LZH file. This vulnerability was discovered binaryhouse.net Module Options msf use exploit/windows/lotus/lotusnotes/lzh msf undefinedlzh show actions ...actions... msf undefinedlzh set...

RealWin SCADA Server DATAC Login Buffer Overflow

This module exploits a stack buffer overflow in DATAC Control International RealWin SCADA Server 2.1 Build 6.0.10.10 or earlier. By sending a specially crafted OnFCCONNECTFCSLOGIN packet containing a long username, an attacker may be able to execute arbitrary code. Module Options msf use...

Windows Escalate UAC Protection Bypass

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. Module Options msf use exploit/windows/local/bypassuac msf undefinedbypassuac show actions ...actions... msf...

BEA Weblogic Transfer-Encoding Buffer Overflow

This module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. This vulnerability exists in the error reporting for unknown Transfer-Encoding headers. You may have to run this twice due to timing issues with handlers. Module Options msf use...

Trend Micro ServerProtect 5.58 Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/antivirus/trendmicro/serverprotect msf undefinedserverprotect...

SSH User Code Execution

This module connects to the target system and executes the necessary commands to run the specified payload via SSH. If a native payload is specified, an appropriate stager will be used. Module Options msf use exploit/multi/ssh/sshexec msf undefinedsshexec show actions ...actions... msf...

FTP Fetch, Windows Upload/Execute, Bind TCP Stager with UUID Support (Windows x86)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Listen for a connection with UUID Support Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework modul...

FTP Fetch, Windows Reverse HTTP Stager (winhttp)

Fetch and execute an x86 payload from an FTP server. Tunnel communication over HTTP Windows winhttp Module Options...

FTP Fetch, Windows shellcode stage, Bind TCP Stager with UUID Support (Windows x86)

Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Listen for a connection with UUID Support Windows x86 Module Options...

Powershell Exec, Reverse All-Port TCP Stager

Execute an x86 payload from a command via PowerShell. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options msf use payload/cmd/windows/powershell/patchupmeterpreter/reversetcpallports msf payloadreversetcpallports show actions ...actions... msf...

Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker Module Options msf use payload/cmd/windows/powershell/vncinject/reversetcprc4 msf payloadreversetcprc4 show actions ...actions... msf payloadreversetcprc4 set ACTION msf payloadreversetcprc4 show options ...show an...

Powershell Exec, Reverse TCP Stager (DNS)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker Module Options msf use payload/cmd/windows/powershell/peinject/reversetcpdns msf payloadreversetcpdns show actions ...actions... msf payloadreversetcpdns set ACTION msf payloadreversetcpdns show options ...show and...

Powershell Exec, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker Module Options msf use payload/cmd/windows/powershell/peinject/reversetcprc4 msf payloadreversetcprc4 show actions ...actions... msf payloadreversetcprc4 set ACTION msf payloadreversetcprc4 show options ...show and...

Powershell Exec, Reverse TCP Stager (No NX or Win7)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker No NX Module Options msf use payload/cmd/windows/powershell/dllinject/reversenonxtcp msf payloadreversenonxtcp show actions ...actions... msf payloadreversenonxtcp set ACTION msf payloadreversenonxtcp show options...

Powershell Exec, Bind IPv6 TCP Stager (Windows x86)

Execute an x86 payload from a command via PowerShell. Listen for an IPv6 connection Windows x86 Module Options msf use payload/cmd/windows/powershell/meterpreter/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf payloadbindipv6tcp show options...

Inductive Automation Ignition Remote Code Execution

This module exploits a Java deserialization vulnerability in the Inductive Automation Ignition SCADA product, versions 8.0.0 to and including 8.0.7. This exploit was tested on versions 8.0.0 and 8.0.7 on both Linux and Windows. The default configuration is exploitable by an unauthenticated...

Pi-Hole heisenbergCompensator Blocklist OS Command Execution

This exploits a command execution in Pi-Hole use exploit/unix/http/pihole/blocklistexec msf undefinedblocklistexec show actions ...actions... msf undefinedblocklistexec set ACTION msf undefinedblocklistexec show options ...show and set options... msf undefinedblocklistexec run This module require...

Foxit PDF Reader Pointer Overwrite UAF

Foxit PDF Reader v9.0.1.1049 has a Use-After-Free vulnerability in the Text Annotations component and the TypedArray's use uninitialized pointers. The vulnerabilities can be combined to leak a vtable memory address, which can be adjusted to point to the base address of the executable. A ROP chain...

Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE

This module exploits a stack Buffer Overflow in the GCore server GCoreServer.exe. The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 Version 1.4.YYYYY. Module Options msf use...

ImageMagick Delegate Arbitrary Command Execution

This module exploits a shell command injection in the way "delegates" commands for converting files are processed in ImageMagick versions use exploit/unix/fileformat/imagemagick/delegate msf undefineddelegate show actions ...actions... msf undefineddelegate set ACTION msf undefineddelegate show...

Apport / ABRT chroot Privilege Escalation

This module attempts to gain root privileges on Linux systems by invoking the default coredump handler inside a namespace "container". Apport versions 2.13 through 2.17.x before 2.17.1 on Ubuntu are vulnerable, due to a feature which allows forwarding reports to a container's Apport by changing t...

Tuleap PHP Unserialize Code Execution

This module exploits a PHP object injection vulnerability in Tuleap use exploit/unix/webapp/tuleap/unserializeexec msf undefinedunserializeexec show actions ...actions... msf undefinedunserializeexec set ACTION msf undefinedunserializeexec show options ...show and set options... msf...