Windows Executable Download and Evaluate VBS

Downloads a file from an HTTPS URL and executes it as a vbs script. Use it to stage a vbs encoded payload from a short command line. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize =...

SAP Management Console Brute Force

This module simply attempts to brute force the username and password for the SAP Management Console SOAP Interface. If the SAPSID value is set it will replace instances of in any user/pass from any wordlist. This module requires Metasploit: https://metasploit.com/download Current source:...

Hewlett-Packard Power Manager Administration Buffer Overflow

This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2. Sending a specially crafted POST request with an overly long Login string, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include

This module exploits a remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Oracle DB SQL Injection via SYS.LT.ROLLBACKWORKSPACE

This module exploits a sql injection flaw in the ROLLBACKWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. This module requires Metasploit: https://metasploit.com/download Current source:...

WinFTP 2.3.0 NLST Denial of Service

This module is a very rough port of Julien Bedard's PoC. You need a valid login, but even anonymous can do it if it has permission to call NLST. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Trend Micro OfficeScan Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in Trend Micro OfficeScan cgiChkMasterPwd.exe running with SYSTEM privileges. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Trend...

TinyIdentD 2.2 Stack Buffer Overflow

This module exploits a stack based buffer overflow in TinyIdentD version 2.2. If we send a long string to the ident service we can overwrite the return address and execute arbitrary code. Credit to Maarten Boone. This module requires Metasploit: https://metasploit.com/download Current source:...

MS06-019 Exchange MODPROP Heap Overflow

This module triggers a heap overflow vulnerability in MS Exchange that occurs when multiple malformed MODPROP values occur in a VCAL request. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

SlimFTPd LIST Concatenation Overflow

This module exploits a stack buffer overflow in the SlimFTPd server. The flaw is triggered when a LIST command is received with an overly-long argument. This vulnerability affects all versions of SlimFTPd prior to 3.16 and was discovered by Raphael Rigo. This module requires Metasploit:...

FTP Fetch, Bind IPv6 TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for an IPv6 connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows x86 Bind Named Pipe Stager

Fetch and execute an x86 payload from an FTP server. Listen for a pipe connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options...

FTP Fetch, Reverse Ordinal TCP Stager (No NX or Win7)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...

FTP Fetch, Reverse All-Port TCP Stager

Fetch and execute an x86 payload from an FTP server. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options...

FTP Fetch, Bind TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for a connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP...

FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options...

FTP Fetch, Reverse All-Port TCP Stager

Fetch and execute an x86 payload from an FTP server. Try to connect back to the attacker, on all possible ports 1-65535, slowly Module Options...

FTP Fetch, Windows x64 Reverse HTTP Stager (winhttp)

Fetch and execute an x64 payload from an FTP server. Tunnel communication over HTTP Windows x64 winhttp Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Reverse TCP Stager

Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options...

FTP Fetch, Bind IPv6 TCP Stager (Windows x86)

Fetch and execute an x86 payload from an FTP server. Listen for an IPv6 connection Windows x86 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux Execute Command

Fetch and execute an x64 payload from an FTP server. Execute an arbitrary command or just a /bin/sh shell Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)

Fetch and execute a x86 payload from an FTP server. Spawn a command shell staged. Listen for an IPv6 connection Linux x86 Module Options...

FTP Fetch

Fetch and execute an ARMBE payload from an FTP server. Module Options msf use payload/cmd/linux/ftp/armbe/meterpreterreversehttps msf payloadmeterpreterreversehttps show actions ...actions... msf payloadmeterpreterreversehttps set ACTION msf payloadmeterpreterreversehttps show options ...show and...

Browse the session filesystem in a Web Browser

This module allows you to browse the session filesystem via a local browser window. Module Options msf use post/multi/manage/fileshare msf postfileshare show actions ...actions... msf postfileshare set ACTION msf postfileshare show options ...show and set options... msf postfileshare run This...

Windows Inject PE Files, Hidden Bind TCP Stager

Inject a custom native PE file into the exploited process using a reflective PE loader. The reflective PE loader will execute the pre-mapped PE image starting from the address of entry after performing image base relocation and API address resolution. This module requires a PE file that contains...

DoS Exploitation of Allen-Bradley's Legacy Protocol (PCCC)

A remote, unauthenticated attacker could send a single, specially crafted Programmable Controller Communication Commands PCCC packet to the controller that could potentially cause the controller to enter a DoS condition. MicroLogix 1100 controllers are affected: 1763-L16BWA, 1763-L16AWA,...

Morris Worm sendmail Debug Mode Shell Escape

This module exploits sendmail's well-known historical debug mode to escape to a shell and execute commands in the SMTP RCPT TO command. This vulnerability was exploited by the Morris worm in 1988-11-02. Cliff Stoll reports on the worm in the epilogue of The Cuckoo's Egg. Currently, only...

Dolibarr Gather Credentials via SQL Injection

This module enables an authenticated user to collect the usernames and encrypted passwords of other users in the Dolibarr ERP/CRM via SQL injection. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModu...

QNAP Q'Center change_passwd Command Execution

This module exploits a command injection vulnerability in the changepasswd API method within the web interface of QNAP Q'Center virtual appliance versions prior to 1.7.1083. The vulnerability allows the 'admin' privileged user account to execute arbitrary commands as the 'admin' operating system...

Hadoop YARN ResourceManager Unauthenticated Command Execution

This module uses Hadoop's standard ResourceManager REST API to execute arbitrary commands on an unsecured Hadoop server. Hadoop administrators should enable Kerberos authentication for these endpoints by changing the 'hadoop.security.authentication' setting in 'core-site.xml' from 'simple' the...

Clickjacking Vulnerability In CSRF Error Page pfSense

This module exploits a Clickjacking vulnerability in pfSense 'Clickjacking Vulnerability In CSRF Error Page pfSense', 'Description' = %q This module exploits a Clickjacking vulnerability in pfSense 'Yorick Koster', 'Payload'...

Multi Gather Docker Credentials Collection

This module will collect the contents of all users' .docker directories on the targeted machine. If the user has already push to docker hub, chances are that the password was saved in base64 default behavior. This module requires Metasploit: https://metasploit.com/download Current source:...

NNTP Login Utility

This module attempts to authenticate to NNTP services which support the AUTHINFO authentication extension. This module supports AUTHINFO USER/PASS authentication, but does not support AUTHINFO GENERIC or AUTHINFO SASL authentication methods. This module requires Metasploit:...

IBM OpenAdmin Tool SOAP welcomeServer PHP Code Execution

This module exploits an unauthenticated remote PHP code execution vulnerability in IBM OpenAdmin Tool included with IBM Informix versions 11.5, 11.7, and 12.1. The 'welcomeServer' SOAP service does not properly validate user input in the 'newhomepage' parameter of the 'saveHomePage' method allowi...

OS X Gather Messages

This module will collect the Messages sqlite3 database files and chat logs from the victim's machine. There are four actions you may choose: DBFILE, READABLE, LATEST, and ALL. DBFILE and READABLE will retrieve all messages, and LATEST will retrieve the last X number of messages useful with 2FA...

BMP Polyglot

Encodes a payload in such a way that the resulting binary blob is both valid x86 shellcode and a valid bitmap image file .bmp. The selected bitmap file to inject into must use the BM Windows 3.1x/95/NT header and the 40-byte Windows 3.1x/NT BITMAPINFOHEADER. Additionally the file must use either ...

PCMan FTP Server 2.0.7 Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability found in PCMan FTP Server 2.0.7. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command that includes file system traversal strings such as '..//' This module requires Metasploit:...

BusyBox Download and Execute

This module will be applied on a session connected to a BusyBox shell. It will use wget to download and execute a file from the device running BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox DNS Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to set the DNS server on the device executing BusyBox so it will be sent by the DHCP server to network hosts. This module requires Metasploit: https://metasploit.com/download Current source:...

Wordpress InfusionSoft Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress Infusionsoft Gravity Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file upload and remote code execution. This module requires Metasploit: https://metasploit.com/download Current source:...

GitLab User Enumeration

The GitLab 'internal' API is exposed unauthenticated on GitLab. This allows the username for each SSH Key ID number to be retrieved. Users who do not have an SSH Key cannot be enumerated in this fashion. LDAP users, e.g. Active Directory users will also be returned. This issue was fixed in GitLab...

Brocade Enable Login Check Scanner

This module will test a range of Brocade network devices for a privileged logins and report successes. The device authentication mode must be set as 'aaa authentication enable default local'. Telnet authentication, e.g. 'enable telnet authentication', should not be enabled in the device...

HP Data Protector 8.10 Remote Command Execution

This module exploits a remote command execution on HP Data Protector 8.10. Arbitrary commands can be executed by sending crafted requests with opcode 28 to the OmniInet service listening on the TCP/5555 port. Since there is a strict length limitation on the command, rundll32.exe is executed, and...

McAfee Virus Scan Enterprise Password Hashes Dump

This module extracts the password hash from McAfee Virus Scan Enterprise VSE used to lock down the user interface. Hashcat supports cracking this type of hash using hash type sha1$salt.unicode$pass -m 140 and a hex salt --hex-salt of 01000f000d003300 unicode "\x01\x0f\x0d\x33". A dynamic format i...

Memcached Extractor

This module extracts the slabs from a memcached instance. It then finds the keys and values stored in those slabs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Memcached Extractor',...

Windows Active Directory Wordlist Builder

This module will gather information from the default Active Domain AD directory and use these words to seed a wordlist. By default it enumerates user accounts to build the wordlist. This module requires Metasploit: https://metasploit.com/download Current source:...

NTP Mode 7 PEER_LIST_SUM DoS Scanner

This module identifies NTP servers which permit "PEERLISTSUM" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service aka, "DRDoS" or traffic amplification via spoofed requests. Thi...

Adobe Flash Player Type Confusion Remote Code Execution

This module exploits a type confusion vulnerability found in the ActiveX component of Adobe Flash Player. This vulnerability was found exploited in the wild in November 2013. This module has been tested successfully on IE 6 to IE 10 with Flash 11.7, 11.8 and 11.9 prior to 11.9.900.170 over Window...