Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)

This module exploits a stack buffer overflow in Lotus Notes 8.5.2 when parsing a malformed, specially crafted LZH file. This vulnerability was discovered binaryhouse.net Module Options msf use exploit/windows/fileformat/lotusnotes/lzh msf undefinedlzh show actions ...actions... msf undefinedlzh s...

7-Technologies IGSS 9 Data Server/Collector Packet Handling Vulnerabilities

This module exploits multiple vulnerabilities found on IGSS 9's Data Server and Data Collector services. The initial approach is first by transferring our binary with Write packets opcode 0x0D via port 12401 igssdataserver.exe, and then send an EXE packet opcode 0x0A to port 12397 dc.exe, which...

IBM Lotus Domino iCalendar MAILTO Buffer Overflow

This module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to...

JBoss Seam 2 File Upload and Execute

Versions of the JBoss Seam 2 framework use exploit/multi/http/jboss/seamuploadexec msf undefinedseamuploadexec show actions ...actions... msf undefinedseamuploadexec set ACTION msf undefinedseamuploadexec show options ...show and set options... msf undefinedseamuploadexec run This module requires...

HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a request containing a cookie longer than 5120 bytes, an attacker can overflow a stack buffer and execute arbitrary code. The vulnerable code is within the OvWwwDebug function. The static-sized stack...

Samba chain_reply Memory Corruption (Linux x86)

This exploits a memory corruption vulnerability present in Samba versions prior to 3.3.13. When handling chained response packets, Samba fails to validate the offset value used when building the next part. By setting this value to a number larger than the destination buffer size, an attacker can...

Amaya Browser v11.0 'bdo' Tag Overflow

This module exploits a stack buffer overflow in the Amaya v11 Browser. By sending an overly long string to the "bdo" tag, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/amaya/bdo msf undefinedbdo show actions ...actions... msf undefinedbdo set...

TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access

This module tests for directory traversal vulnerability in the UpdateAgent function in the OfficeScanNT Listener TmListen.exe service in Trend Micro OfficeScan. This allows remote attackers to read arbitrary files as SYSTEM via dot dot sequences in an HTTP request. This module requires Metasploit...

Victory FTP Server 5.0 LIST DoS

The Victory FTP Server v5.0 can be brought down by sending a very simple LIST command Module Options msf use auxiliary/dos/windows/ftp/vicftps50/list msf undefinedlist show actions ...actions... msf undefinedlist set ACTION msf undefinedlist show options ...show and set options... msf undefinedli...

Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Electronic Arts SnoopyCtrl ActiveX Control NPSnpy.dll 1.1.0.36. When sending an overly long string to the CheckRequirements method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/ea/checkrequirement...

D-Link TFTP 1.0 Long Filename Buffer Overflow

This module exploits a stack buffer overflow in D-Link TFTP 1.0. By sending a request for an overly long file name, an attacker could overflow a buffer and execute arbitrary code. For best results, use bind payloads with nonx No NX. Module Options msf use exploit/windows/tftp/dlink/longfilename m...

Symantec Remote Management Buffer Overflow

This module exploits a stack buffer overflow in Symantec Client Security 3.0.x. This module has only been tested against Symantec Client Security 3.0.2 build 10.0.2.2000. Module Options msf use exploit/windows/antivirus/symantec/rtvscan msf undefinedrtvscan show actions ...actions... msf...

Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow

This module exploits a buffer overflow in the CRAM-MD5 authentication of the MDaemon IMAP service. This vulnerability was discovered by Muts. Module Options msf use exploit/windows/imap/mdaemon/crammd5 msf undefinedcrammd5 show actions ...actions... msf undefinedcrammd5 set ACTION msf...

Microsoft Windows Authenticated User Code Execution

This module uses a valid administrator username and password or password hash to execute an arbitrary payload. This module is similar to the "psexec" utility provided by SysInternals. This module is now able to clean up after itself. The service created by this tool uses a randomly chosen name an...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows shellcode stage, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows x64 Command Shell, Windows x64 Bind TCP Stager

Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Listen for a connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch, Windows x64 Command Shell, Bind TCP Inline

Fetch and execute an x64 payload from an FTP server. Listen for a connection and spawn a command shell Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch

Fetch and execute an x86 payload from an FTP server. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP include...

FTP Fetch, Windows Upload/Execute, Reverse All-Port TCP Stager

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options This module requires Metasploit: https://metasploit.com/download Current source:...

FTP Fetch, Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Connect back to the attacker Module Options...

FTP Fetch, Bind TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for a connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP...

Python Exec, Command Shell, Bind TCP (via python)

Execute a Python payload as an OS command from a Posix-compatible shell. Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.4-2.7 and 3.4+. Module Options msf use payload/cmd/unix/python/shellbindtcp msf payloadshellbindtcp show actions ...actions...

WordPress AIT CSV Import Export Unauthenticated Remote Code Execution

The AIT CSV Import/Export plugin use exploit/multi/http/wp/aitcsvrce msf undefinedaitcsvrce show actions ...actions... msf undefinedaitcsvrce set ACTION msf undefinedaitcsvrce show options ...show and set options... msf undefinedaitcsvrce run This module requires Metasploit:...

Veeam ONE Agent .NET Deserialization

This module exploits a .NET deserialization vulnerability in the Veeam ONE Agent before the hotfix versions 9.5.5.4587 and 10.0.1.750 in the 9 and 10 release lines. Specifically, the module targets the HandshakeResult method used by the Agent. By inducing a failure in the handshake, the Agent wil...

RARLAB WinRAR ACE Format Input Validation Remote Code Execution

In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format in UNACEV2.dll. When the filename field is manipulated with specific patterns, the destination extraction folder is ignored, thus treating the filename as an...

Microsoft Exchange Privilege Escalation Exploit

This module exploits a privilege escalation vulnerability found in Microsoft Exchange - CVE-2019-0724 Execution of the module will force Exchange to authenticate to an arbitrary URL over HTTP via the Exchange PushSubscription feature. This allows us to relay the NTLM authentication to a Domain...

NETGEAR ProSafe Network Management System 300 Authenticated File Download

Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems. The application has a file download vulnerability that can be exploited by an authenticated remote attacker to download any file in the system. This module has been tested with versions 1.5.0.2, 1.4.0.17 and...

Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow

This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser encoded audio inside a FLV video, as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 32-bit, IE11 and Adobe Flash 18.0.0.160, Windows 7 SP1 32-bit, Firefox 38.0.5 a...

HP Intelligent Management BIMS DownloadServlet Directory Traversal

This module exploits a lack of authentication and a directory traversal in HP Intelligent Management, specifically in the DownloadServlet from the BIMS component, in order to retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully on HP Intelligent Management...

Telnet Login Check Scanner

This module will test a telnet login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access. This module requires Metasploit:...

MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution

This module exploits the MiniUPnP 1.0 SOAP stack buffer overflow vulnerability present in the SOAPAction HTTP header handling. Module Options msf use exploit/linux/upnp/miniupnpd/soapbof msf undefinedsoapbof show actions ...actions... msf undefinedsoapbof set ACTION msf undefinedsoapbof show...

Unix Command Shell, Reverse TCP SSL (via perl)

Creates an interactive shell via perl, uses SSL This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 173 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

Polycom Command Shell Authorization Bypass

The login component of the Polycom Command Shell on Polycom HDX video endpoints, running software versions 3.0.5 and earlier, is vulnerable to an authorization bypass when simultaneous connections are made to the service, allowing remote network attackers to gain access to a sandboxed telnet prom...

Wordpress Pingback Locator

This module will scan for wordpress sites with the Pingback API enabled. By interfacing with the API an attacker can cause the wordpress site to port scan an external target and return results. Refer to the wordpresspingbackportscanner module. This issue was fixed in wordpress 3.5.1 This module...

NTP Clock Variables Disclosure

This module reads the system internal NTP variables. These variables contain potentially sensitive information, such as the NTP software version, operating system version, peers, and more. This module requires Metasploit: https://metasploit.com/download Current source:...

Novell ZENworks Asset Management 7.5 Remote File Access

This module exploits a hardcoded user and password for the GetFile maintenance task in Novell ZENworks Asset Management 7.5. The vulnerability exists in the Web Console and can be triggered by sending a specially crafted request to the rtrlet component, allowing a remote unauthenticated user to...

Setuid Tunnelblick Privilege Escalation

This module exploits a vulnerability in Tunnelblick 3.2.8 on Mac OS X. The vulnerability exists in the setuid openvpnstart, where an insufficient validation of path names allows execution of arbitrary shell scripts as root. This module has been tested successfully on Tunnelblick 3.2.8 build...

SystemTap MODPROBE_OPTIONS Privilege Escalation

This module attempts to gain root privileges by exploiting a vulnerability in the staprun executable included with SystemTap version 1.3. The staprun executable does not clear environment variables prior to executing modprobe, allowing an arbitrary configuration file to be specified in the...

Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability

This module exploits an authentication bypass vulnerability in login.php in order to execute arbitrary code via a command injection vulnerability in propertybox.php. This module was tested against Oracle Secure Backup version 10.3.0.1.0 Win32. Module Options msf use...

Windows Media Services ConnectFunnel Stack Buffer Overflow

This module exploits a stack buffer overflow in the Windows Media Unicast Service version 4.1.0.3930 NUMS.exe. By sending a specially crafted FunnelConnect request, an attacker can execute arbitrary code under the "NetShowServices" user account. Windows Media Services 4.1 ships with Windows 2000...

Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability

This module exploits an authentication bypass vulnerability in login.php in order to execute arbitrary code via a command injection vulnerability in propertybox.php. This module was tested against Oracle Secure Backup version 10.3.0.1.0 Win32. Module Options msf use...

Worldweaver DX Studio Player shell.execute() Command Execution

This module exploits a command execution vulnerability within the DX Studio Player from Worldweaver for versions 3.0.29 and earlier. The player is a browser plugin for IE ActiveX and Firefox dll. When an unsuspecting user visits a web page referring to a specially crafted .dxstudio document, an...

Symantec Altiris DS SQL Injection

This module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8 to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize numeric input fields in "UpdateComputer" notification Requests. In order to spawn a shell, several SQL injections are...

phpBB viewtopic.php Arbitrary Code Execution

This module exploits two arbitrary PHP code execution flaws in the phpBB forum system. The problem is that the 'highlight' parameter in the 'viewtopic.php' script is not verified properly and will allow an attacker to inject arbitrary code via pregreplace. This vulnerability was introduced in...

FTP Fetch, Windows shellcode stage, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Listen for a pipe connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows Upload/Execute, Bind TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Uploads an executable and runs it staged. Listen for a connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Windows x64 Command Shell, Reverse TCP Stager with UUID Support (Windows x64)

Fetch and execute an x64 payload from an FTP server. Spawn a piped command shell Windows x64 staged. Connect back to the attacker with UUID Support Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source:...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...