Native DNS Spoofer (Example)

This module provides a Rex based DNS service to resolve queries intercepted via the capture mixin. Configure STATICENTRIES to contain host-name mappings desired for spoofing using a hostsfile or space/semicolon separated entries. In the default configuration, the service operates as a normal nati...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution

This module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage' method allowi...

DnaLIMS Directory Traversal

This module exploits a directory traversal vulnerability found in dnaLIMS. Due to the way the viewAppletFsa.cgi script handles the 'secID' parameter, it is possible to read a file outside the www directory. This module requires Metasploit: https://metasploit.com/download Current source:...

OS X Gather Messages

This module will collect the Messages sqlite3 database files and chat logs from the victim's machine. There are four actions you may choose: DBFILE, READABLE, LATEST, and ALL. DBFILE and READABLE will retrieve all messages, and LATEST will retrieve the last X number of messages useful with 2FA...

Censys Search

The module uses the Censys REST API to access the same data accessible through the web interface. The search endpoint allows queries using the Censys Search Language against the Hosts dataset. Setting the CERTIFICATES option will also retrieve the certificate details for each relevant service by...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 'Hak5 WiFi Pineapple Preconfiguration Command Injection', 'Description' = %q This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 = pineapple 2.4. We use a combination of default...

Windows Gather MDaemonEmailServer Credential Cracking

Finds and cracks the stored passwords of MDaemon Email Server This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'base64' class MetasploitModule 'Windows Gather MDaemonEmailServer Credential Cracking',...

Generate TCP/UDP Outbound Traffic On Multiple Ports

This module generates TCP or UDP traffic across a sequence of ports, and is useful for finding firewall holes and egress filtering. It only generates traffic on the port range you specify. It is up to you to run a responder or packet capture tool on a remote endpoint to determine which ports are...

Novell ServiceDesk Authenticated File Upload

This module exploits an authenticated arbitrary file upload via directory traversal to execute code on the target. It has been tested on versions 6.5 and 7.1.0, in Windows and Linux installations of Novell ServiceDesk, as well as the Virtual Appliance provided by Novell. This module requires...

UNIX Gather RSYNC Credentials

Post Module to obtain credentials saved for RSYNC in various locations This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UNIX Gather RSYNC Credentials', 'Description' = %q Post Module to obtain...

VNC Keyboard Remote Code Execution

This module exploits VNC servers by sending virtual keyboard keys and executing a payload. On Windows systems a command prompt is opened and a PowerShell or CMDStager payload is typed and executed. On Unix/Linux systems a xterm terminal is opened and a payload is typed and executed. This module...

McAfee Virus Scan Enterprise Password Hashes Dump

This module extracts the password hash from McAfee Virus Scan Enterprise VSE used to lock down the user interface. Hashcat supports cracking this type of hash using hash type sha1$salt.unicode$pass -m 140 and a hex salt --hex-salt of 01000f000d003300 unicode "\x01\x0f\x0d\x33". A dynamic format i...

Windows Active Directory Wordlist Builder

This module will gather information from the default Active Domain AD directory and use these words to seed a wordlist. By default it enumerates user accounts to build the wordlist. This module requires Metasploit: https://metasploit.com/download Current source:...

NTP Mode 7 PEER_LIST_SUM DoS Scanner

This module identifies NTP servers which permit "PEERLISTSUM" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service aka, "DRDoS" or traffic amplification via spoofed requests. Thi...

Ericom AccessNow Server Buffer Overflow

This module exploits a stack based buffer overflow in Ericom AccessNow Server. The vulnerability is due to an insecure usage of vsprintf with user controlled data, which can be triggered with a malformed HTTP request. This module has been tested successfully with Ericom AccessNow Server 2.4.0.2 o...

Wireshark wiretap/mpeg.c Stack Buffer Overflow

This module triggers a stack buffer overflow in Wireshark 'Wireshark wiretap/mpeg.c Stack Buffer Overflow', 'Description' = %q This module triggers a stack buffer overflow in Wireshark MSFLICENSE, 'Author' = 'Wesley Neelen', Discovery vulnerability 'j0sm1', Exploit and msf module , 'References' =...

Easy CD-DA Recorder PLS Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in Easy CD-DA Recorder 2007 caused by an overlong string in a playlist entry. By persuading the victim to open a specially-crafted PLS file, a remote attacker can execute arbitrary code on the system or cause the application to cras...

Windows Gather SmarterMail Password Extraction

This module extracts and decrypts the sysadmin password in the SmarterMail 'mailConfig.xml' configuration file. The encryption key and IV are publicly known. This module has been tested successfully on SmarterMail versions 10.7.4842 and 11.7.5136. This module requires Metasploit:...

IBM Forms Viewer Unicode Buffer Overflow

This module exploits a stack-based buffer overflow in IBM Forms Viewer. The vulnerability is due to a dangerous usage of a strcpy-like function, and occurs while parsing malformed XFDL files containing a long fontname value. This module has been tested successfully on IBM Forms Viewer 4.0 on...

Windows Gather Skype, Firefox, and Chrome Artifacts

Gathers Skype chat logs, Firefox history, and Chrome history data from the target machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'csv' class MetasploitModule 'Windows Gather Skype, Firefox, and Chrom...

Ruby on Rails Action View MIME Memory Exhaustion

This module exploits a Denial of Service DoS condition in Action View that requires a controller action. By sending a specially crafted content-type header to a Rails application, it is possible for it to store the invalid MIME type, and may eventually consume all memory if enough invalid MIMEs a...

HP Intelligent Management SOM FileDownloadServlet Arbitrary Download

This module exploits a lack of authentication and access control in HP Intelligent Management, specifically in the FileDownloadServlet from the SOM component, in order to retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully on HP Intelligent Management Center...

GLPI install.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the GLPI 'install.php' script. This module is set to ManualRanking due to this module overwriting the target database configuration, which may introduce target instability. This module requires Metasploit:...

Unix Command Shell, Bind TCP (via Lua)

Listen for a connection and spawn a command shell via Lua This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 218 include Msf::Payload::Single include Msf::Sessions::CommandShellOption...

Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution

This module exploits a vulnerability found in the Oracle WebCenter Content CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav, where user controlled input is used to call ShellExecuteExW. This module abuses the control to execute an arbitrary HTA from a remote location. This...

SonicWALL GMS 6 Arbitrary File Upload

This module exploits a code execution flaw in SonicWALL GMS. It exploits two vulnerabilities in order to get its objective. An authentication bypass in the Web Administration interface allows to abuse the "appliance" application and upload an arbitrary payload embedded in a JSP. The module has be...

Linksys WRT54GL Remote Command Execution

Some Linksys Routers are vulnerable to OS Command injection. You will need credentials to the web interface to access the vulnerable part of the application. Default credentials are always a good starting point. admin/admin or admin and blank password could be a first try. Note: This is a blind O...

Windows Manage Safe Delete

The goal of the module is to hinder the recovery of deleted files by overwriting its contents. This could be useful when you need to download some file on the victim machine and then delete it without leaving clues about its contents. Note that the script does not wipe the free disk space so...

TestLink v1.9.3 Arbitrary File Upload Vulnerability

This module exploits a vulnerability in TestLink version 1.9.3 or prior. This application has an upload feature that allows any authenticated user to upload arbitrary files to the '/uploadarea/nodeshierarchy/' directory with a randomized file name. The file name can be retrieved from the database...

Umbraco CMS Remote Command Execution

This module can be used to execute a payload on Umbraco CMS 4.7.0.378. The payload is uploaded as an ASPX script by sending a specially crafted SOAP request to codeEditorSave.asmx, which permits unauthorized file upload via the SaveDLRScript operation. SaveDLRScript is also subject to a path...

Lattice Semiconductor ispVM System XCF File Handling Overflow

This module exploits a vulnerability found in ispVM System 18.0.2. Due to the way ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially crafted file, when a long value is supplied for the version attribute of the ispXCF tag. It results in arbitrary code execution...

Windows Manage PowerShell Download and/or Execute

This module will download and execute a PowerShell script over a meterpreter session. The user may also enter text substitutions to be made in memory before execution. Setting VERBOSE to true will output both the script prior to execution and the results. This module requires Metasploit:...

UNIX Gather .fetchmailrc Credentials

Post Module to obtain credentials saved for IMAP, POP and other mail retrieval protocols in fetchmail's .fetchmailrc This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UNIX Gather .fetchmailrc...

Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the Linux BSD-derived telnet service inetutils or krb5-telnet. Most Linux distributions use NetKit-derived telnet daemons, so this flaw only applies to a small subset of Linux systems running telnetd. -- coding: binary --...

Unix Command Shell, Bind TCP (via perl) IPv6

Listen for a connection and spawn a command shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Sessions::CommandShellOptio...

Wireshark console.lua Pre-Loading Script Execution

This module exploits a vulnerability in Wireshark 1.6 or less. When opening a pcap file, Wireshark will actually check if there's a 'console.lua' file in the same directory, and then parse/execute the script if found. Versions affected by this vulnerability: 1.6.0 to 1.6.1, 1.4.0 to 1.4.8 This...

HTTP Cross-Site Tracing Detection

Checks if the host is vulnerable to Cross-Site Tracing XST This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Cross-Site Tracing Detection', 'Description' = 'Checks if the host is vulnerable ...

Multi Gather OpenSSH PKI Credentials Collection

This module will collect the contents of all users' .ssh directories on the targeted machine. Additionally, knownhosts and authorizedkeys and any other files are also downloaded. This module is largely based on firefoxcreds.rb. This module requires Metasploit: https://metasploit.com/download...

PcVue 10.0 SV.UIGrdCtrl.1 'LoadObject()/SaveObject()' Trusted DWORD Vulnerability

This module exploits a function pointer control within SVUIGrd.ocx of PcVue 10.0. By setting a dword value for the SaveObject or LoadObject, an attacker can overwrite a function pointer and execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Executable Download and Evaluate VBS

Downloads a file from an HTTPS URL and executes it as a vbs script. Use it to stage a vbs encoded payload from a short command line. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize =...

SAP Management Console Brute Force

This module simply attempts to brute force the username and password for the SAP Management Console SOAP Interface. If the SAPSID value is set it will replace instances of in any user/pass from any wordlist. This module requires Metasploit: https://metasploit.com/download Current source:...

Adobe U3D CLODProgressiveMeshDeclaration Array Overrun

This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include 'Adobe U3D CLODProgressiveMeshDeclaration Array Overrun', 'Description' = %q This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include MSFLICENSE, 'Author'...

Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include

This module exploits a remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Java JSP Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1501 include Msf::Payload::Single include Msf::Payload::JSP include...

Foxit Reader Authorization Bypass

This module exploits an authorization bypass vulnerability in Foxit Reader build 1120. When an attacker creates a specially crafted pdf file containing an Open/Execute action, arbitrary commands can be executed without confirmation from the victim. This module requires Metasploit:...

UoW IMAP Server LSUB Buffer Overflow

This module exploits a buffer overflow in the 'LSUB' command of the University of Washington IMAP service. This vulnerability can only be exploited with a valid username and password. This module requires Metasploit: https://metasploit.com/download Current source:...

BolinTech Dream FTP Server 1.02 Format String

This module exploits a format string overflow in the BolinTech Dream FTP Server version 1.02. Based on the exploit by SkyLined. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BolinTech Dream F...

TinyIdentD 2.2 Stack Buffer Overflow

This module exploits a stack based buffer overflow in TinyIdentD version 2.2. If we send a long string to the ident service we can overwrite the return address and execute arbitrary code. Credit to Maarten Boone. This module requires Metasploit: https://metasploit.com/download Current source:...

Samba trans2open Overflow (Mac OS X PPC)

This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the bug on Mac OS X PowerPC systems. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

MS02-056 Microsoft SQL Server Hello Overflow

By sending malformed data to TCP port 1433, an unauthenticated remote attacker could overflow a buffer and possibly execute code on the server with SYSTEM level privileges. This module should work against any vulnerable SQL Server 2000 or MSDE install 'MS02-056 Microsoft SQL Server Hello Overflow...