IBM Data Risk Manager Unauthenticated Remote Code Execution

IBM Data Risk Manager IDRM contains three vulnerabilities that can be chained by an unauthenticated attacker to achieve remote code execution as root. The first is an unauthenticated bypass, followed by a command injection as the server user, and finally abuse of an insecure default password. Thi...

IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution

This module exploits a vulnerability in IBM TM1 / Planning Analytics that allows an unauthenticated attacker to perform a configuration overwrite. It starts by querying the Admin server for the available applications, picks one, and then exploits it. You can also provide an application name to...

Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution

This module exploits a vulnerability in the getprofile.sh script of Nagios XI prior to 5.6.6 in order to upload a malicious checkping plugin and thereby execute arbitrary commands. For Nagios XI 5.2.0-5.4.13, the commands are run as the nagios user. For versions 5.5.0-5.6.5 the commands are run a...

Xorg X11 Server SUID modulepath Privilege Escalation

This module attempts to gain root privileges with SUID Xorg X11 server versions 1.19.0 use exploit/multi/local/xorg/x11suidservermodulepath msf undefinedx11suidservermodulepath show actions ...actions... msf undefinedx11suidservermodulepath set ACTION msf undefinedx11suidservermodulepath show...

Windows NtUserSetWindowFNID Win32k User Callback

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Serv...

Microsoft Windows Defender Evasive JS.Net and HTA

This module will generate an HTA file that writes and compiles a JScript.NET file containing shellcode on the target machine. After compilation, the generated EXE will execute the shellcode without interference from Windows Defender. It is recommended that you use a payload that uses RC4 or HTTPS...

phpCollab 2.5.1 Unauthenticated File Upload

This module exploits a file upload vulnerability in phpCollab 2.5.1 which could be abused to allow unauthenticated users to execute arbitrary code under the context of the web server user. The exploit has been tested on Ubuntu 16.04.3 64-bit Module Options msf use...

Regsvr32.exe (.sct) Application Whitelisting Bypass Server

This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts an .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This...

Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow

This module exploits an SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which leads to an SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerabilit...

Windows Domain Controller Hashdump

This module attempts to copy the NTDS.dit database from a live Domain Controller and then parse out all of the User Accounts. It saves all of the captured password hashes, including historical ones. This module requires Metasploit: https://metasploit.com/download Current source:...

SAP Web GUI Login Brute Forcer

This module attempts to brute force SAP username and passwords through the SAP Web GUI service. Default clients can be tested without needing to set a CLIENT. Common and default user/password combinations can be tested just setting the DEFAULTCRED variable to true. The...

SugarCRM unserialize() PHP Code Execution

This module exploits a php unserialize vulnerability in SugarCRM use exploit/unix/webapp/sugarcrm/unserializeexec msf undefinedunserializeexec show actions ...actions... msf undefinedunserializeexec set ACTION msf undefinedunserializeexec show options ...show and set options... msf...

EMC Replication Manager Command Execution

This module exploits a remote command-injection vulnerability in EMC Replication Manager client irccd.exe. By sending a specially crafted message invoking RunProgram function an attacker may be able to execute arbitrary commands with SYSTEM privileges. Affected products are EMC Replication Manage...

Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability

This module exploits an authentication bypass vulnerability in login.php in order to execute arbitrary code via a command injection vulnerability in propertybox.php. This module was tested against Oracle Secure Backup version 10.3.0.1.0 Win32. Module Options msf use...

Oracle DB 11g R1/R2 DBMS_JVM_EXP_PERMS OS Code Execution

This module exploits a flaw 0 day in DBMSJVMEXPPERMS package that allows any user with create session privilege to grant themselves java IO privileges. Identified by David Litchfield. Works on 11g R1 and R2 Windows only. This module requires Metasploit: https://metasploit.com/download Current...

MS09-072 Microsoft Internet Explorer Style getElementsByTagName Memory Corruption

This module exploits a vulnerability in the getElementsByTagName function as implemented within Internet Explorer. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule HttpClients::IE, :uaminver =...

Powershell Exec, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Execute an x86 payload from a command via PowerShell. Listen for a connection Module Options msf use payload/cmd/windows/powershell/dllinject/bindtcprc4 msf payloadbindtcprc4 show actions ...actions... msf payloadbindtcprc4 set ACTION msf payloadbindtcprc4 show options ...show and set options...

K-Meleon Credential Gatherer

This module searches for K-Meleon credentials on a Windows host. Module Options msf use post/windows/gather/credentials/kmeleon msf postkmeleon show actions ...actions... msf postkmeleon set ACTION msf postkmeleon show options ...show and set options... msf postkmeleon run This module requires...

Mikrotik Gather Device General Information

This module collects Mikrotik device information and configuration. This module has been tested against RouterOS 6.45.9. Module Options msf use post/networking/gather/enummikrotik msf postenummikrotik show actions ...actions... msf postenummikrotik set ACTION msf postenummikrotik show options...

Ricoh Driver Privilege Escalation

Various Ricoh printer drivers allow escalation of privileges on Windows systems. For vulnerable drivers, a low-privileged user can read/write files within the RICOHDRV directory and its subdirectories. PrintIsolationHost.exe, a Windows process running as NT AUTHORITY\SYSTEM, loads driver-specific...

Apache Solr Remote Code Execution via Velocity Template

This module exploits a vulnerability in Apache Solr use exploit/multi/http/solr/velocityrce msf undefinedvelocityrce show actions ...actions... msf undefinedvelocityrce set ACTION msf undefinedvelocityrce show options ...show and set options... msf undefinedvelocityrce run This module requires...

Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE

This module exploits a php object instantiation vulnerability that can lead to RCE in Shopware. An authenticated backend user could exploit the vulnerability. The vulnerability exists in the createInstanceFromNamedArguments function, where the code insufficiently performs whitelist check which ca...

Nuuo Central Management Server User Session Token Bruteforce

Nuuo Central Management Server below version 2.4 has a flaw where it sends the heap address of the user object instead of a real session number when a user logs in. This can be used to reduce the keyspace for the session number from 10 million to 1.2 million, and with a bit of analysis it can be...

GoAhead Web Server LD_PRELOAD Arbitrary Module Load

This module triggers an arbitrary shared library load vulnerability in GoAhead web server versions between 2.5 and that have the CGI module enabled. Module Options msf use exploit/linux/http/goahead/ldpreload msf undefinedldpreload show actions ...actions... msf undefinedldpreload set ACTION msf...

Xplico Remote Code Execution

This module exploits command injection vulnerability. Unauthenticated users can register a new account and then execute a terminal command under the context of the root user. The specific flaw exists within the Xplico, which listens on TCP port 9876 by default. The goal of Xplico is extract from ...

IPFire proxy.cgi RCE

IPFire, a free linux based open source firewall distribution, version use exploit/linux/http/ipfire/oinkcodeexec msf undefinedoinkcodeexec show actions ...actions... msf undefinedoinkcodeexec set ACTION msf undefinedoinkcodeexec show options ...show and set options... msf undefinedoinkcodeexec ru...

PhoenixContact PLC Remote START/STOP Command

PhoenixContact Programmable Logic Controllers are built upon a variant of ProConOS. Communicating using a proprietary protocol over ports TCP/1962 and TCP/41100 or TCP/20547. It allows a remote user to read out the PLC Type, Firmware and Build number on port TCP/1962. And also to read out the CPU...

Firefox PDF.js Privileged Javascript Injection

This module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs. PDF.js is used to exploit the bug. This exploit requires the user to click anywhere on the page to trigger the vulnerability. Module Options msf use...

Wordpress SlideShow Gallery Authenticated File Upload

The Wordpress SlideShow Gallery plugin contains an authenticated file upload vulnerability. An attacker can upload arbitrary files to the upload folder. Since the plugin uses its own file upload mechanism instead of the WordPress API, it's possible to upload any file type. Module Options msf use...

Windows Manage Change Password

This module will attempt to change the password of the targeted account. The typical usage is to change a newly created account's password on a remote host to avoid the error, 'System error 1907 has occurred,' which is caused when the account policy enforces a password change before the next logi...

ElasticSearch Dynamic Script Arbitrary Java Execution

This module exploits a remote command execution RCE vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.2.0. The bug is found in the REST API, which does not require authentication, where the search function allows dynamic scripts execution. It can be used for remot...

Portable UPnP SDK unique_service_name() Remote Code Execution

This module exploits a buffer overflow in the uniqueservicename function of libupnp's SSDP processor. The libupnp library is used across thousands of devices and is referred to as the Intel SDK for UPnP Devices or the Portable SDK for UPnP Devices. Due to size limitations on many devices, this...

KingView Log File Parsing Buffer Overflow

This module exploits a vulnerability found in KingView use exploit/windows/fileformat/kingview/kingmesskvl msf undefinedkingmesskvl show actions ...actions... msf undefinedkingmesskvl set ACTION msf undefinedkingmesskvl show options ...show and set options... msf undefinedkingmesskvl run This...

Setuid Tunnelblick Privilege Escalation

This module exploits a vulnerability in Tunnelblick 3.2.8 on Mac OS X. The vulnerability exists in the setuid openvpnstart, where an insufficient validation of path names allows execution of arbitrary shell scripts as root. This module has been tested successfully on Tunnelblick 3.2.8 build...

Support Incident Tracker Remote Command Execution

This module combines two separate issues within Support Incident Tracker use exploit/multi/http/sit/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options ...show and set options... msf undefinedfileupload run This...

Sun Java System Web Server WebDAV OPTIONS Buffer Overflow

This module exploits a buffer overflow in Sun Java Web Server prior to version 7 Update 8. By sending an "OPTIONS" request with an overly long path, attackers can execute arbitrary code. In order to reach the vulnerable code, the attacker must also specify the path to a directory with WebDAV...

Amaya Browser v11.0 'bdo' Tag Overflow

This module exploits a stack buffer overflow in the Amaya v11 Browser. By sending an overly long string to the "bdo" tag, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53. An attacker may be able to execute arbitrary code by sending an overly long string to the "ShortFormat" method in askbar.dll. This module requires Metasploit: https://metasploit.com/download Current source:...

Mercur Messaging 2005 IMAP Login Buffer Overflow

This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3. Since the room for shellcode is small, using the reverse ordinal payloads yields the best results. This module requires Metasploit: https://metasploit.com/download Current source:...

SoftiaCom WMailserver 1.0 Buffer Overflow

This module exploits a stack buffer overflow in SoftiaCom WMailserver 1.0 SMTP via a SEH frame overwrite. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SoftiaCom WMailserver 1.0 Buffer...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x64 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

Bookmarked Sites Retriever

This module discovers information about a target by retrieving their bookmarked websites on Google Chrome, Opera and Microsoft Edge. Module Options msf use post/windows/gather/getbookmarks msf postgetbookmarks show actions ...actions... msf postgetbookmarks set ACTION msf postgetbookmarks show...

Powershell Exec, Reverse HTTP Stager Proxy

Execute an x86 payload from a command via PowerShell. Tunnel communication over HTTP Module Options msf use payload/cmd/windows/powershell/meterpreter/reversehttpproxypstore msf payloadreversehttpproxypstore show actions ...actions... msf payloadreversehttpproxypstore set ACTION msf...

Powershell Exec, Windows x64 Bind TCP Stager

Execute an x64 payload from a command via PowerShell. Listen for a connection Windows x64 Module Options msf use payload/cmd/windows/powershell/x64/peinject/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show and set options...

Opera Credential Gatherer

This module searches for Opera credentials on a Windows host. Module Options msf use post/windows/gather/credentials/opera msf postopera show actions ...actions... msf postopera set ACTION msf postopera show options ...show and set options... msf postopera run This module requires Metasploit:...

Apache Tapestry HMAC secret key leak

This exploit finds the HMAC secret key used in Java serialization by Apache Tapestry. This key is located in the file AppModule.class by default and looks like the standard representation of UUID in hex digits hd : 6hd-4hd-4hd-4hd-12hd If the HMAC key has been changed to look differently, this...

Micro Focus UCMDB Java Deserialization Unauthenticated Remote Code Execution

This module exploits two vulnerabilities, that when chained allow an attacker to achieve unauthenticated remote code execution in Micro Focus UCMDB. UCMDB included in versions 2020.05 and below of Operations Bridge Manager are affected, but this module can probably also be used to exploit...

John the Ripper Windows Password Cracker (Fast Mode)

This module uses John the Ripper to identify weak passwords that have been acquired as hashed files loot or raw LANMAN/NTLM hashes hashdump. The goal of this module is to find trivial passwords in a short amount of time. To crack complex passwords or use large wordlists, John the Ripper should be...

ES File Explorer Open Port

This module connects to ES File Explorer's HTTP server to run certain commands. The HTTP server is started on app launch, and is available as long as the app is open. Version 4.1.9.7.4 and below are reported vulnerable This module has been tested against 4.1.9.5.1. Module Options msf use...

Apple_iOS Meterpreter, Reverse HTTPS Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 643824 include...