Wordpress Scanner

Detects Wordpress Versions, Themes, Plugins, and Users This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Scanner', 'Description' = 'Detects Wordpress Versions, Themes, Plugins, and...

ERS Viewer 2011 ERS File Handling Buffer Overflow

This module exploits a buffer overflow vulnerability found in ERS Viewer 2011 version 11.04. The vulnerability exists in the module ermapperu.dll where the function ERMconverttocorrectwebpath handles user provided data in an insecure way. It results in arbitrary code execution under the context o...

HP Intelligent Management FaultDownloadServlet Directory Traversal

This module exploits a lack of authentication and a directory traversal in HP Intelligent Management, specifically in the FaultDownloadServlet, in order to retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully on HP Intelligent Management Center 5.1 E0202 over...

TP-Link Wireless Lite N Access Point Directory Traversal Vulnerability

This module tests whether a directory traversal vulnerability is present in versions of TP-Link Access Point 3.12.16 Build 120228 Rel.37317n. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Unix Command Shell, Reverse TCP SSL (telnet)

Creates an interactive shell via mkfifo and telnet. This method works on Debian and other systems compiled without /dev/tcp support. This module uses the '-z' option included on some systems to encrypt using SSL. This module requires Metasploit: https://metasploit.com/download Current source:...

Freesshd Authentication Bypass

This module exploits a vulnerability found in FreeSSHd "Freesshd Authentication Bypass", 'Description' = %q This module exploits a vulnerability found in FreeSSHd MSFLICENSE, 'Author' = 'Aris', Vulnerability discovery and Exploit 'kcope', 2012 Exploit 'Daniele Martini ', Metasploit module 'Imran ...

Windows Gather Google Chrome User Data Enumeration

This module will collect user data from Google Chrome and attempt to decrypt sensitive information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Google Chrome User Data...

Foswiki MAKETEXT Remote Command Execution

This module exploits a vulnerability in the MAKETEXT Foswiki variable. By using a specially crafted MAKETEXT, a malicious user can execute shell commands since the input is passed to the Perl "eval" command without first being sanitized. The problem is caused by an underlying security issue in th...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow

This module exploits a heap overflow found in InduSoft Web Studio HttpClients::IE, :uaminver = "6.0", :uamaxver = "9.0", :javascript = true, :osname = OperatingSystems::Match::WINDOWS, :rank = NormalRanking, :classid = "3c9dff6f-5cb0-422e-9978-d6405d10718f", :method = "InternationalSeparator" def...

NFR Agent Heap Overflow Vulnerability

This module exploits a heap overflow in NFRAgent.exe, a component of Novell File Reporter NFR. The vulnerability occurs when handling requests of name "SRS", where NFRAgent.exe fails to generate a response in a secure way, copying user controlled data into a fixed-length buffer in the heap withou...

Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution

This module exploits an authentication bypass vulnerability on Avaya IP Office Customer Call Reporter, which allows a remote user to upload arbitrary files through the ImageUpload.ashx component. It can be abused to upload and execute arbitrary ASP .NET code. The vulnerability has been tested...

NTR ActiveX Control Check() Method Buffer Overflow

This module exploits a vulnerability found in NTR ActiveX 1.1.8. The vulnerability exists in the Check method, due to the insecure usage of strcat to build a URL using the bstrParams parameter contents note: this is also the reason why the module won't allow you to modify the URIPATH, which leads...

Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow

This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer 6.21. As a .pac file, when supplying a long string of data to the 'value' field under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption on the stack, which results in arbitrary code executi...

TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow

This module exploits a vulnerability in the CmdProcessor.exe component of Trend Micro Control Manger up to version 5.5. The specific flaw exists within CmdProcessor.exe service running on TCP port 20101. The vulnerable function is the CGenericScheduler::AddTask function of...

Windows Gather Credentials IMVU Game Client

This module extracts account username & password from the IMVU game client and stores it as loot. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Credentials...

CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection

This module exploits a SQL injection flaw in CA Total Defense Suite R12. When supplying a specially crafted soap request to '/UNCWS/Management.asmx', an attacker can abuse the reGenerateReports stored procedure by injecting arbitrary sql statements into the ReportIDs element. This module requires...

HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a request containing a cookie longer than 5120 bytes, an attacker can overflow a stack buffer and execute arbitrary code. The vulnerable code is within the OvWwwDebug function. The static-sized stack...

MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow

This is an exploit for the chunked encoding buffer overflow described in MS03-051 and originally reported by Brett Moore. This particular modules works against versions of Windows 2000 between SP0 and SP3. Service Pack 4 fixes the issue. This module requires Metasploit:...

Oracle DB 10gR2, 11gR1/R2 DBMS_JVM_EXP_PERMS OS Command Execution

This module exploits a flaw 0 day in DBMSJVMEXPPERMS package that allows any user with create session privilege to grant themselves java IO privileges. Identified by David Litchfield. Works on 10g R2, 11g R1 and R2 Windows only This module requires Metasploit: https://metasploit.com/download...

FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow

This module exploits a simple stack buffer overflow in FreeFTPd 1.0.10 This flaw is due to a buffer overflow error when handling a specially crafted key exchange algorithm string received from an SSH client. This module is based on MC's freesshdkeyexchange exploit. This module requires Metasploit...

Omni-NFS Server Buffer Overflow

This module exploits a stack buffer overflow in Xlink Omni-NFS Server 5.2 When sending a specially crafted nfs packet, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

BigAnt Server 2.50 SP1 Buffer Overflow

This exploits a stack buffer overflow in the BigAnt Messaging Service, part of the BigAnt Server product suite. This module was tested successfully against version 2.50 SP1. This module requires Metasploit: https://metasploit.com/download Current source:...

Wardialer

Scan for dial-up systems that are connected to modems and answer telephony indials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zlib' Extend Object class to include savetofile and loadfromfile methods cla...

Novell iPrint Client ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Novell iPrint Client 4.34. When sending an overly long string to the GetDriverSettings property of ienipp.ocx an attacker may be able to execute arbitrary code. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download...

TFTPDWIN v0.4.2 Long Filename Buffer Overflow

This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending an overly long file name to the tftpd.exe server, the stack can be overwritten. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

WS-FTP Server 5.03 MKD Overflow

This module exploits the buffer overflow found in the MKD command in IPSWITCH WSFTP Server 5.03 discovered by Reed Arvin. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WS-FTP Server 5.03 MKD...

OneDrive Sync Provider Enumeration Module

This module will identify the Office 365 OneDrive endpoints for both business and personal accounts across all users providing access is permitted. It is useful for identifying document libraries that may otherwise not be obvious which could contain sensitive or useful information. Module Options...

IBM Data Risk Manager a3user Default Password

This module abuses a known default password in IBM Data Risk Manager. The 'a3user' has the default password 'idrm' and allows an attacker to log in to the virtual appliance via SSH. This can be escalate to full root access, as 'a3user' has sudo access with the default password. At the time of...

VMware Fusion USB Arbitrator Setuid Privilege Escalation

This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3. The Open VMware USB Arbitrator Service can be launched outide of its standard path which allows loading of an attacker controlled binary. By creating a payload in the user home directory in a specific folder, a...

Cisco UCS Director Unauthenticated Remote Code Execution

The Cisco UCS Director virtual appliance contains two flaws that can be combined and abused by an attacker to achieve remote code execution as root. The first one, CVE-2019-1937, is an authentication bypass, that allows the attacker to authenticate as an administrator. The second one,...

Cisco Data Center Network Manager Unauthenticated Remote Code Execution

DCNM exposes a file upload servlet FileUploadServlet at /fm/fileUpload. An authenticated user can abuse this servlet to upload a WAR to the Apache Tomcat webapps directory and achieve remote code execution as root. This module exploits two other vulnerabilities, CVE-2019-1619 for authentication...

Microsoft Windows Contact File Format Arbitary Code Execution

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The flaw is due to the processing of ".contact...

CMS Made Simple Authenticated RCE via File Upload/Copy

CMS Made Simple allows an authenticated administrator to upload a file and rename it to have a .php extension. The file can then be executed by opening the URL of the file in the /uploads/ directory. This module has been successfully tested on CMS Made Simple versions 2.2.5 and 2.2.7. This module...

Metasploit msfd Remote Code Execution via Browser

Metasploit's msfd-service makes it possible to get a msfconsole-like interface over a TCP socket. This module connects to the msfd-socket through the victim's browser. To execute msfconsole-commands in JavaScript from a web application, this module places the payload in the POST-data. These...

Command Shell, Reverse UDP (via python)

Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include...

Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow

This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16 by using the import command option to import a specially crafted xml file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

UDP Amplification Scanner

Detect UDP endpoints with UDP amplification vulnerabilities This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UDP Amplification Scanner', 'Description' = 'Detect UDP endpoints with UDP...

Ubiquiti airOS Arbitrary File Upload

This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...

Linux DoS Xen 4.2.0 2012-5525

This module causes a hypervisor crash in Xen 4.2.0 when invoked from a paravirtualized VM, including from dom0. Successfully tested on Debian 7 3.2.0-4-amd64 with Xen 4.2.0. This module requires Metasploit: https://metasploit.com/download Current source:...

Web-Dorado ECommerce WD for Joomla! search_category_id SQL Injection Scanner

This module will scan for hosts vulnerable to an unauthenticated SQL injection within the advanced search feature of the Web-Dorado ECommerce WD 1.2.5 and likely prior. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Java Debug Wire Protocol Remote Code Execution

This module abuses exposed Java Debug Wire Protocol services in order to execute arbitrary Java code remotely. It just abuses the protocol features, since no authentication is required if the service is enabled. This module requires Metasploit: https://metasploit.com/download Current source:...

Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution

On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given invalid input, would throw an exception that did not have an exposedProps property set. By re-setting this property on the exception object's prototype, the chrome-based defineProperty method is made available. With...

Modbus Client Utility

This module allows reading and writing data to a PLC using the Modbus protocol. This module is based on the 'modiconstop.rb' Basecamp module from DigitalBond, as well as the mbtget perl script. This module requires Metasploit: https://metasploit.com/download Current source:...

Mac OS X Sudo Password Bypass

This module gains a session with root permissions on versions of OS X with sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4, and possibly lower versions. If your session belongs to a user with Administrative Privileges the user is in the sudoers file and is in the...

Microsoft Windows Deployment Services Unattend Gatherer

This module will search remote file shares for unattended installation files that may contain domain credentials. This is often used after discovering domain credentials with the auxiliary/scanner/dcerpc/windowsdeploymentservices module or in cases where you already have domain credentials. This...

Adobe Flash Player ActionScript Launch Command Execution Vulnerability

This module exploits a vulnerability in Adobe Flash Player for Linux, version 10.0.12.36 and 9.0.151.0 and prior. An input validation vulnerability allows command execution when the browser loads a SWF file which contains shell metacharacters in the arguments to the ActionScript launch method. Th...

DNS TXT Record Payload Download and Execution

Performs a TXT query against a series of DNS records and executes the returned x86 shellcode. The DNSZONE option is used as the base name to iterate over. The payload will first request the TXT contents of the a hostname, followed by b, then c, etc. until there are no more records. For each recor...

Windows Capture Winlogon Lockout Credential Keylogger

This module migrates and logs Microsoft Windows user's passwords via Winlogon.exe using idle time and natural system changes to give a false sense of security to the user. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

Metasploit Web Crawler

This auxiliary module is a modular web crawler, to be used in conjunction with wmap someday or standalone. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Web Crawler. Author: Efrain Torres et at metasploit.com 2010...

SMB File Upload Utility

This module uploads a file to a target share and path. The only reason to use this module is if your existing SMB client is not able to support the features of the Metasploit Framework that you need, like pass-the-hash authentication. This module requires Metasploit: https://metasploit.com/downlo...