Powershell Exec, Reverse TCP Stager (IPv6)

Execute an x86 payload from a command via PowerShell. Connect back to the attacker over IPv6 Module Options msf use payload/cmd/windows/powershell/patchupmeterpreter/reverseipv6tcp msf payloadreverseipv6tcp show actions ...actions... msf payloadreverseipv6tcp set ACTION msf payloadreverseipv6tcp...

Digsby Credential Gatherer

This module searches for Digsby credentials on a Windows host. Module Options msf use post/windows/gather/credentials/digsby msf postdigsby show actions ...actions... msf postdigsby set ACTION msf postdigsby show options ...show and set options... msf postdigsby run This module requires Metasploi...

Seamonkey Credential Gatherer

This module searches for seamonkey credentials on a Windows host. Module Options msf use post/windows/gather/credentials/seamonkey msf postseamonkey show actions ...actions... msf postseamonkey set ACTION msf postseamonkey show options ...show and set options... msf postseamonkey run This module...

Multi Manage the screen of the target meterpreter session

This module allows you to view and control the screen of the target computer via a local browser window. The module continually screenshots the target screen and also relays all mouse and keyboard events to session. This module requires Metasploit: https://metasploit.com/download Current source:...

PlaySMS index.php Unauthenticated Template Injection Code Execution

This module exploits a preauth Server-Side Template Injection vulnerability that leads to remote code execution in PlaySMS before version 1.4.3. This issue is caused by double processing a server-side template with a custom PHP template system called 'TPL' which is used in the PlaySMS template...

Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution

This module exploits a vulnerability in the getprofile.sh script of Nagios XI prior to 5.6.6 in order to upload a malicious checkping plugin and thereby execute arbitrary commands. For Nagios XI 5.2.0-5.4.13, the commands are run as the nagios user. For versions 5.5.0-5.6.5 the commands are run a...

Google Chrome 72 and 73 Array.map exploit

This module exploits an issue in Chrome 73.0.3683.86 64 bit. The exploit corrupts the length of a float in order to modify the backing store of a typed array. The typed array can then be used to read and write arbitrary memory. The exploit then uses WebAssembly in order to allocate a region of RW...

Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe) and Registry

This module exploits a flaw in the WSReset.exe file associated with the Windows Store. This binary has autoelevate privs, and it will run a binary file contained in a low-privilege registry location. By placing a link to the binary in the registry location, WSReset.exe will launch the binary as a...

GoAhead Web Server LD_PRELOAD Arbitrary Module Load

This module triggers an arbitrary shared library load vulnerability in GoAhead web server versions between 2.5 and that have the CGI module enabled. Module Options msf use exploit/linux/http/goahead/ldpreload msf undefinedldpreload show actions ...actions... msf undefinedldpreload set ACTION msf...

Apple Remote Desktop Root Vulnerability

Enable and set root account to a chosen password on unpatched macOS High Sierra hosts with either Screen Sharing or Remote Management enabled. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

SSH Public Key Login Scanner

This module will test ssh logins on a range of machines using a defined private key file, and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access. Key files may be a single...

Supervisor XML-RPC Authenticated Remote Code Execution

This module exploits a vulnerability in the Supervisor process control software, where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how...

Windows Privilege Escalation via TokenMagic (UAC Bypass)

This module leverages a UAC bypass TokenMagic in order to spawn a process/conduct a DLL hijacking attack to gain SYSTEM-level privileges. Windows 7 through Windows 10 1803 are affected. Module Options msf use exploit/windows/local/tokenmagic msf undefinedtokenmagic show actions ...actions... msf...

Juju-run Agent Privilege Escalation

This module attempts to gain root privileges on Juju agent systems running the juju-run agent utility. Juju agent systems running agent tools prior to version 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3, provide a UNIX domain socket to manage software "units" without setting appropriate...

AlienVault OSSIM/USM Remote Code Execution

This module exploits object injection, authentication bypass and ip spoofing vulnerabilities all together. Unauthenticated users can execute arbitrary commands under the context of the root user. By abusing authentication bypass issue on gauge.php lead adversaries to exploit object injection...

Cisco IKE Information Disclosure

A vulnerability in Internet Key Exchange version 1 IKEv1 packet processing code in Cisco IOS, Cisco IOS XE, and Cisco IOS XR Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is d...

Drupal CODER Module Remote Command Execution

This module exploits a Remote Command Execution vulnerability in the Drupal CODER Module. Unauthenticated users can execute arbitrary commands under the context of the web server user. The CODER module doesn't sufficiently validate user inputs in a script file that has the PHP extension. A...

Windows Gather Credentials Local Administrator Password Solution

This module will recover the LAPS Local Administrator Password Solution passwords, configured in Active Directory, which is usually only accessible by privileged users. Note that the local administrator account name is not stored in Active Directory, so it is assumed to be 'Administrator' by...

Arris / Motorola Surfboard SBG6580 Web Interface Takeover

The web interface for the Arris / Motorola Surfboard SBG6580 has several vulnerabilities that, when combined, allow an arbitrary website to take control of the modem, even if the user is not currently logged in. The attacker must successfully know, or guess, the target's internal gateway IP...

FreePBX config.php Remote Code Execution

This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11. It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php" parameters "function" and "args". Module Options msf use exploit/unix/webapp/freepbx/configexec msf undefinedconfigexec show...

Adobe Flash Player Integer Underflow Remote Code Execution

This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 12.0.0.43. By supplying a specially crafted swf file it is possible to trigger an integer underflow in several avm2 instructions, which can be turned into remote code execution under the context of th...

OpenMediaVault Cron Remote Command Execution

OpenMediaVault allows an authenticated user to create cron jobs as arbitrary users on the system. An attacker can abuse this to run arbitrary commands as any user available on the system including root. This module requires Metasploit: https://metasploit.com/download Current source:...

Kimai v0.9.2 'db_restore.php' SQL Injection

This module exploits a SQL injection vulnerability in Kimai version 0.9.2.x. The 'dbrestore.php' file allows unauthenticated users to execute arbitrary SQL queries. This module writes a PHP payload to disk if the following conditions are met: The PHP configuration must have 'displayerrors' enable...

Windows Gather Microsoft Office Word UNC Path Injector

This module modifies a remote .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. Verified to work with Microsoft Word 2003, 2007, 2010, and 2013. In order to get the hashes the auxiliary/server/capture/smb module can be used. This module requires Metasploit:...

KingView Log File Parsing Buffer Overflow

This module exploits a vulnerability found in KingView use exploit/windows/fileformat/kingview/kingmesskvl msf undefinedkingmesskvl show actions ...actions... msf undefinedkingmesskvl set ACTION msf undefinedkingmesskvl show options ...show and set options... msf undefinedkingmesskvl run This...

Linux udev Netlink Local Privilege Escalation

Versions of udev use exploit/linux/local/udev/netlink msf undefinednetlink show actions ...actions... msf undefinednetlink set ACTION msf undefinednetlink show options ...show and set options... msf undefinednetlink run This module requires Metasploit: https://metasploit.com/download Current...

Titan FTP Server 6.26.630 SITE WHO DoS

The Titan FTP server v6.26 build 630 can be DoS'd by issuing "SITE WHO". You need a valid login so you can send this command. Module Options msf use auxiliary/dos/windows/ftp/titan626/site msf undefinedsite show actions ...actions... msf undefinedsite set ACTION msf undefinedsite show options...

XM Easy Personal FTP Server 5.6.0 NLST DoS

This module is a port of shinnai's script. You need a valid login, but even anonymous can do it as long as it has permission to call NLST. Module Options msf use auxiliary/dos/windows/ftp/xmeasy560/nlst msf undefinednlst show actions ...actions... msf undefinednlst set ACTION msf undefinednlst sh...

Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the vcsteu.dll FileTransfer Module 1.0.0.5 ActiveX control in the Tumbleweed SecureTransport suite. By sending an overly long string to the TransferFile 'remotefile' function, an attacker may be able to execute arbitrary code. Module Options msf use...

Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53. An attacker may be able to execute arbitrary code by sending an overly long string to the "ShortFormat" method in askbar.dll. Module Options msf use exploit/windows/browser/ask/shortformat msf undefinedshortformat show...

Solaris srsexec Arbitrary File Reader

This module exploits a vulnerability in NetCommander 3.2.3 and 3.2.5. When srsexec is executed in debug -d verbose -v mode, the first line of an arbitrary file can be read due to the suid bit set. The most widely accepted exploitation vector is reading /etc/shadow, which will reveal root's hash f...

MS06-066 Microsoft Services nwapi32.dll Module Exploit

This module exploits a stack buffer overflow in the svchost service when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. Module Options msf use exploit/windows/smb/ms06/066nwapi msf undefined066nwapi show actions ...actions... msf undefined066nwapi...

Mercur Messaging 2005 IMAP Login Buffer Overflow

This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3. Since the room for shellcode is small, using the reverse ordinal payloads yields the best results. Module Options msf use exploit/windows/imap/mercur/login msf undefinedlogin show actions ...actions... msf undefinedlogin...

Mercantec SoftCart CGI Overflow

This is an exploit for an undisclosed buffer overflow in the SoftCart.exe CGI as shipped with Mercantec's shopping cart software. It is possible to execute arbitrary code by passing a malformed CGI parameter in an HTTP GET request. This issue is known to affect SoftCart version 4.00b. Module...

QuickTime Streaming Server parse_xml.cgi Remote Execution

The QuickTime Streaming Server contains a CGI script that is vulnerable to metacharacter injection, allow arbitrary commands to be executed as root. Module Options msf use exploit/unix/webapp/qtss/parsexmlexec msf undefinedparsexmlexec show actions ...actions... msf undefinedparsexmlexec set ACTI...

Microsoft SQL Server Payload Execution via SQL Injection

This module will execute an arbitrary payload on a Microsoft SQL Server, using a SQL injection vulnerability. Once a vulnerability is identified this module will use xpcmdshell to upload and execute Metasploit payloads. It is necessary to specify the exact point where the SQL injection...

FTP Fetch, DNS TXT Record Payload Download and Execution

Fetch and execute an x86 payload from an FTP server. Performs a TXT query against a series of DNS records and executes the returned x86 shellcode. The DNSZONE option is used as the base name to iterate over. The payload will first request the TXT contents of the a hostname, followed by b, then c,...

FTP Fetch, Reverse All-Port TCP Stager

Fetch and execute an x86 payload from an FTP server. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options...

FTP Fetch, Reverse TCP Stager with UUID Support

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker with UUID Support Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Find Tag Ordinal Stager

Fetch and execute an x86 payload from an FTP server. Use an established connection Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP inclu...

FTP Fetch, Windows x86 Pingback, Reverse TCP Inline

Fetch and execute an x86 payload from an FTP server. Connect back to attacker and report UUID Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options...

FTP Fetch, Windows Meterpreter Shell, Reverse TCP Inline x64

Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

FTP Fetch

Fetch and execute an x86 payload from an FTP server. Module Options...

FTP Fetch, Windows Command Shell, Reverse TCP Stager (No NX or Win7)

Fetch and execute an x86 payload from an FTP server. Spawn a piped command shell staged. Connect back to the attacker No NX Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule includ...

FTP Fetch, Windows x64 Bind Named Pipe Stager

Fetch and execute an x64 payload from an FTP server. Listen for a pipe connection Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows shellcode stage, Windows Reverse HTTP Stager (wininet)

Fetch and execute an x86 payload from an FTP server. Custom shellcode stage. Tunnel communication over HTTP Windows wininet Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule includ...

Comodo Credential Gatherer

This module searches for credentials stored in Comodo on a Windows host. Module Options msf use post/windows/gather/credentials/comodo msf postcomodo show actions ...actions... msf postcomodo set ACTION msf postcomodo show options ...show and set options... msf postcomodo run This module requires...

PEAR Archive_Tar 1.4.10 Arbitrary File Write

This module takes advantages of ArchiveTar use exploit/multi/fileformat/archive/tararbfilewrite msf undefinedtararbfilewrite show actions ...actions... msf undefinedtararbfilewrite set ACTION msf undefinedtararbfilewrite show options ...show and set options... msf undefinedtararbfilewrite run Thi...

Mikrotik Gather Device General Information

This module collects Mikrotik device information and configuration. This module has been tested against RouterOS 6.45.9. Module Options msf use post/networking/gather/enummikrotik msf postenummikrotik show actions ...actions... msf postenummikrotik set ACTION msf postenummikrotik show options...