Winamp MAKI Buffer Overflow

This module exploits a stack based buffer overflow in Winamp 5.55. The flaw exists in the genff.dll and occurs while parsing a specially crafted MAKI file, where memmove is used in an insecure way with user controlled data. To exploit the vulnerability the attacker must convince the victim to...

MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow

This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP. By supplying a .xls file with a malformed OBJ recType 0x5D record an attacker can get the control of the execution flow. This results in arbitrary code execution under the context of the user. This module requires...

Windows Escalation

This module uses the getsystem command to escalate the current session to the SYSTEM account using various techniques. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Windows...

TYPO3 sa-2010-020 Remote File Disclosure

This module exploits a flaw in the way the TYPO3 jumpurl feature matches hashes. Due to this flaw a Remote File Disclosure is possible by matching the juhash of 0. This flaw can be used to read any file that the web server user account has access to view. This module requires Metasploit:...

DaqFactory HMI NETB Request Overflow

This module exploits a stack buffer overflow in Azeotech's DaqFactory product. The specific vulnerability is triggered when sending a specially crafted 'NETB' request to port 20034. Exploitation of this vulnerability may take a few seconds due to the use of egghunter. This vulnerability was one o...

Black Ice Cover Page ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control BIImgFrm.ocx 12.0.0.0. Code execution can be achieved by first uploading the payload to the remote machine, and then uploa...

ICONICS WebHMI ActiveX Buffer Overflow

This module exploits a vulnerability found in ICONICS WebHMI's ActiveX control. By supplying a long string of data to the 'SetActiveXGUID' parameter, GenVersion.dll fails to do any proper bounds checking before this input is copied onto the stack, which causes a buffer overflow, and results...

MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption

This module exploits a memory corruption vulnerability within Microsoft's HTML engine mshtml. When parsing an HTML page containing a specially crafted CSS tag, memory corruption occurs that can lead arbitrary code execution. It seems like Microsoft code inadvertently increments a vtable pointer t...

rexec Authentication Scanner

This module will test an rexec service on a range of machines and report successful logins. NOTE: This module requires access to bind to privileged ports below 1024. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework cla...

AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow

This module exploits a buffer overflow vulnerability in opcode 21 handled by rpc.cmsd on AIX. By making a request with a long string passed to the first argument of the "rtablecreate" RPC, a stack based buffer overflow occurs. This leads to arbitrary code execution. NOTE: Unsuccessful attempts ma...

IBM Tivoli Storage Manager Express RCA Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express Remote Client Agent service. By sending a "dicuGetIdentify" request packet containing a long NodeName parameter, an attacker can execute arbitrary code. NOTE: this exploit first connects to the CAD service to...

Zabbix Agent net.tcp.listen Command Injection

This module exploits a metacharacter injection vulnerability in the FreeBSD and Solaris versions of the Zabbix agent. This flaw can only be exploited if the attacker can hijack the IP address of an authorized server as defined in the configuration file. This module requires Metasploit:...

HTTPDX tolog() Function Format String Vulnerability

This module exploits a format string vulnerability in HTTPDX HTTP server. By sending a specially crafted HTTP request containing format specifiers, an attacker can corrupt memory and execute arbitrary code. By default logging is off for HTTP, but enabled for the 'moderator' user via FTP. This...

Symantec ConsoleUtilities ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Symantecs ConsoleUtilities. By sending an overly long string to the "BrowseAndSaveFile" method located in the AeXNSConsoleUtilities.dll 6.0.0.1846 Control, an attacker may be able to execute arbitrary code This module requires Metasploit:...

Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption

This module exploits a memory corruption within the MSVidCtl component of Microsoft DirectShow BDATuner.MPEG2TuneRequest. By loading a specially crafted GIF file, an attacker can overrun a buffer and execute arbitrary code. ClassID is now configurable via an advanced option otherwise randomized -...

Seattle Lab Mail 5.5 POP3 Buffer Overflow

There exists an unauthenticated buffer overflow vulnerability in the POP3 server of Seattle Lab Mail 5.5 when sending a password with excessive length. Successful exploitation should not crash either the service or the server; however, after initial use the port cannot be reused for successive...

WebSTAR FTP Server USER Overflow

This module exploits a stack buffer overflow in the logging routine of the WebSTAR FTP server. Reliable code execution is obtained by a series of hops through the System library. This module requires Metasploit: https://metasploit.com/download Current source:...

Maxthon Credential Gatherer

This module searches for Maxthon credentials on a Windows host. Module Options msf use post/windows/gather/credentials/maxthon msf postmaxthon show actions ...actions... msf postmaxthon set ACTION msf postmaxthon show options ...show and set options... msf postmaxthon run This module requires...

Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...

SaltStack Salt API Unauthenticated RCE through wheel_async client

This module leverages an authentication bypass and directory traversal vulnerabilities in Saltstack Salt's REST API to execute commands remotely on the master as the root user. Every 60 seconds, salt-master service performs a maintenance process check that reloads and executes all the grains on t...

Nuuo Central Management Server Authenticated Arbitrary File Upload

The COMMITCONFIG verb is used by a CMS client to upload and modify the configuration of the CMS Server. The vulnerability is in the "FileName" parameter, which accepts directory traversal ..\..\ characters. Therefore, this function can be abused to overwrite any files in the installation drive of...

PlaySMS sendfromfile.php Authenticated "Filename" Field Code Execution

This module exploits a code injection vulnerability within an authenticated file upload feature in PlaySMS v1.4. This issue is caused by improper file name handling in sendfromfile.php file. Authenticated Users can upload a file and rename the file with a malicious payload. This module was tested...

pfSense authenticated graph status RCE

pfSense, a free BSD based open source firewall distribution, version 'pfSense authenticated graph status RCE', 'Description' = %q pfSense, a free BSD based open source firewall distribution, version 'Security-Assessment.com', discovery 'Milton Valencia', metasploit module...

JCL to Escalate Privileges

Elevate privileges for user. Adds SYSTEM SPECIAL and BPX.SUPERUSER to user profile. Does this by using an unsecured/updateable APF authorized library APFLIB and updating the user's ACEE using this program/library. Note: This privesc only works with z/OS systems using RACF, no other ESM is...

Apache Struts Jakarta Multipart Parser OGNL Injection

This module exploits a remote code execution vulnerability in Apache Struts version 2.3.5 - 2.3.31, and 2.5 - 2.5.10. Remote Code Execution can be performed via http Content-Type header. Native payloads will be converted to executables and dropped in the server's temp dir. If this fails, try a cm...

Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal

This module exploits a directory traversal vulnerability in Cisco Firepower Management under the context of www user. Authentication is required to exploit this vulnerability. This module requires Metasploit: https://metasploit.com/download Current source:...

Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability

This module exploits a vulnerability found in Cisco Firepower Management Console. The management system contains a configuration flaw that allows the www user to execute the useradd binary, which can be abused to create backdoor accounts. Authentication is required to exploit this vulnerability...

Linux ARM Big Endian Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 118 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

Windows Manage Privilege Based Process Migration

This module will migrate a Meterpreter session based on session privileges. It will do everything it can to migrate, including spawning a new User level process. For sessions with Admin rights: It will try to migrate into a System level process in the following order: ANAME if specified,...

Symantec Endpoint Protection Manager Authentication Bypass and Code Execution

This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. The vulnerabilities include an authentication bypass, a directory traversal and a privilege escalation to get privileged code execution...

Mac OS X Safari file:// Redirection Sandbox Escape

Versions of Safari before 8.0.6, 7.1.6, and 6.2.6 are vulnerable to a "state management issue" that allows a browser window to be navigated to a file:// URL. By dropping and loading a malicious .webarchive file, an attacker can read arbitrary files, inject cross-domain Javascript, and silently...

Firefox Proxy Prototype Privileged Javascript Injection

This exploit gains remote code execution on Firefox 31-34 by abusing a bug in the XPConnect component and gaining a reference to the privileged chrome:// window. This exploit requires the user to click anywhere on the page to trigger the vulnerability. This module requires Metasploit:...

VNC Server (Reflective Injection), Reverse Hop HTTP/HTTPS Stager

Inject a VNC Dll via a reflective loader staged. Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop. This module requires Metasploit: https://metasploit.com/download Current source:...

Linux Gather Virtual Environment Detection

This module attempts to determine whether the system is running inside of a virtual environment and if so, which one. This module supports detection of Hyper-V, VMWare, VirtualBox, Xen, Bhyve and QEMU/KVM. This module requires Metasploit: https://metasploit.com/download Current source:...

OpenX Backdoor PHP Code Execution

OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013. Exploitation is simple, requiring only a single request with a rot13'd and reversed payload. This module requires Metasploit: https://metasploit.com/download Current source:...

POP3 Login Utility

This module attempts to authenticate to an POP3 service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/pop3' require 'metasploit/framework/credentialcollection' class...

Microsoft SQL Server Database Link Crawling Command Execution

This module can be used to crawl MS SQL Server database links and deploy Metasploit payloads through links configured with sysadmin privileges using a valid SQL Server Login. If you are attempting to obtain multiple reverse shells using this module we recommend setting the "DisablePayloadHandler"...

Generic HTTP Directory Traversal Utility

This module allows you to test if a web server or web application is vulnerable to directory traversal with three different actions. The 'CHECK' action default is used to automatically or manually find if directory traversal exists in the web server, and then return the path that triggers the...

Adobe Flash Player Object Type Confusion

This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt AMF0 "error" response, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "World Uyghur Congress...

MS11-093 Microsoft Windows OLE Object File Handling Remote Code Execution

This module exploits a type confusion vulnerability in the OLE32 component of Windows XP SP3. The vulnerability exists in the CPropertyStorage::ReadMultiple function. A Visio document with a specially crafted Summary Information Stream embedded allows to get remote code execution through Internet...

Adobe Reader U3D Memory Corruption Vulnerability

This module exploits a vulnerability in the U3D handling within versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader. The vulnerability is due to the use of uninitialized memory. Arbitrary code execution is achieved by embedding specially crafted U3D data into a PDF document. A hea...

BNAT Router

This module will properly route BNAT traffic and allow for connections to be established to machines on ports which might not otherwise be accessible. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Novell iPrint Client ActiveX Control call-back-url Buffer Overflow

This module exploits a stack-based buffer overflow in Novell iPrint Client 5.42. When sending an overly long string to the 'call-back-url' parameter in an op-client-interface-version action of ienipp.ocx an attacker may be able to execute arbitrary code. This module requires Metasploit:...

Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger

This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in the MDSYS.SDOTOPODROPFTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme 2-stage attack. This module...

Ultra Shareware Office Control ActiveX HttpUpload Buffer Overflow

This module exploits a stack-based buffer overflow in Ultra Shareware's Office Control. When processing the 'HttpUpload' method, the arguments are concatenated together to form a command line to run a bundled version of cURL. If the command fails to run, a stack-based buffer overflow occurs when...

QuickTime Streaming Server parse_xml.cgi Remote Execution

The QuickTime Streaming Server contains a CGI script that is vulnerable to metacharacter injection, allow arbitrary commands to be executed as root. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModu...

HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow

This module exploits a stack buffer overflow in HTML Help Workshop 4.74 by creating a specially crafted hhp file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTML Help Workshop 4.74 hhp...

McAfee Visual Trace ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX Control NeoTraceExplorer.dll 1.0.0.1. By sending an overly long string to the "TraceTarget" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

PAJAX Remote Command Execution

RedTeam has identified two security flaws in PAJAX 'PAJAX Remote Command Execution', 'Description' = %q RedTeam has identified two security flaws in PAJAX 'Matteo Cantoni ', 'hdm' , 'License' = MSFLICENSE, 'References' = 'CVE', '2006-1551', 'OSVDB', '24618', 'BID', '17519', 'URL',...

NaviCOPA 2.0.1 URL Handling Buffer Overflow

This module exploits a stack buffer overflow in NaviCOPA 2.0.1. The vulnerability is caused due to a boundary error within the handling of URL parameters. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...