Windows Run Command As User

This module will login with the specified username/password and execute the supplied command as a hidden process. Output is not returned by default. Unless targeting a local user either set the DOMAIN, or specify a UPN user format e.g. user@domain. This uses the CreateProcessWithLogonW WinAPI...

AlienVault Authenticated SQL Injection Arbitrary File Read

AlienVault 4.6.1 and below is susceptible to an authenticated SQL injection attack against newpolicyform.php, using the 'insertinto' parameter. This module exploits the vulnerability to read an arbitrary file from the file system. Any authenticated user is able to exploit this, as administrator...

Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free

This module exploits a use after free vulnerability in Adobe Flash Player. The vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying to uncompress a malformed byte stream. This module has been tested successfully on: Windows 7 SP1 32 bits, IE 8 to IE 11 and Flash...

Powershell Base64 Command Encoder

This encodes the command as a base64 encoded command for powershell. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework include Msf::Post::Windows class MetasploitModule 'Powershell Base64 Command Encoder', 'Description'...

Ruby on Rails Action View MIME Memory Exhaustion

This module exploits a Denial of Service DoS condition in Action View that requires a controller action. By sending a specially crafted content-type header to a Rails application, it is possible for it to store the invalid MIME type, and may eventually consume all memory if enough invalid MIMEs a...

Huawei Datacard Information Disclosure Vulnerability

This module exploits an unauthenticated information disclosure vulnerability in Huawei SOHO routers. The module will gather information by accessing the /api pages where authentication is not required, allowing configuration changes as well as information disclosure, including any stored SMS...

Unix Command Shell, Bind TCP (via Lua)

Listen for a connection and spawn a command shell via Lua This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 218 include Msf::Payload::Single include Msf::Sessions::CommandShellOption...

GLPI install.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the GLPI 'install.php' script. This module is set to ManualRanking due to this module overwriting the target database configuration, which may introduce target instability. Module Options msf use exploit/multi/http/glpi/installr...

Canon Printer Wireless Configuration Disclosure

This module enumerates wireless credentials from Canon printers with a web interface. It has been tested on Canon models: MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920. Module Options msf use auxiliary/scanner/http/canon/wireless msf undefinedwireless show actions ...actions... msf...

CouchDB Enum Utility

This module enumerates databases on CouchDB using the REST API without authentication by default. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CouchDB Enum Utility', 'Description' = %q This...

Oracle WebCenter Content CheckOutAndOpen.dll ActiveX Remote Code Execution

This module exploits a vulnerability found in the Oracle WebCenter Content CheckOutAndOpenControl ActiveX. This vulnerability exists in openWebdav, where user controlled input is used to call ShellExecuteExW. This module abuses the control to execute an arbitrary HTA from a remote location. This...

Linux Manage Download and Execute

This module downloads and runs a file with bash. It first tries to uses curl as its HTTP client and then wget if it's not found. Bash found in the PATH is used to execute the file. This module requires Metasploit: https://metasploit.com/download Current source:...

Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure

This module tests vulnerable IIS HTTP header file paths on Microsoft Exchange OWA 2003 and CAS 2007, 2010, and 2013 servers. Module Options msf use auxiliary/scanner/http/owa/iisinternalip msf undefinediisinternalip show actions ...actions... msf undefinediisinternalip set ACTION msf...

NFR Agent FSFUI Record File Upload RCE

NFRAgent.exe, a component of Novell File Reporter NFR, allows remote attackers to upload arbitrary files via a directory traversal while handling requests to /FSF/CMD with FSFUI records with UICMD 130. This module has been tested successfully against NFR Agent 1.0.4.3 File Reporter 1.0.2 and NFR...

WordPress Plugin Advanced Custom Fields Remote File Inclusion

This module exploits a remote file inclusion flaw in the WordPress blogging software plugin known as Advanced Custom Fields. The vulnerability allows for remote file inclusion and remote code execution via the export.php script. The Advanced Custom Fields plug-in versions 3.5.1 and below are...

EMC Networker Format String

This module exploits a format string vulnerability in the lgsprintf function as implemented in liblocal.dll on EMC Networker products. This module exploits the vulnerability by using a specially crafted RPC call to the program number 0x5F3DD, version 0x02, and procedure 0x06. This module has been...

Linux Gather Network Information

This module gathers network information from the target system IPTables rules, interfaces, wireless information, open and listening ports, active network connections, DNS information and SSH information. This module requires Metasploit: https://metasploit.com/download Current source:...

UNIX Gather .fetchmailrc Credentials

Post Module to obtain credentials saved for IMAP, POP and other mail retrieval protocols in fetchmail's .fetchmailrc This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UNIX Gather .fetchmailrc...

ScriptFTP LIST Remote Buffer Overflow

AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow vulnerability that is triggered when processing a sufficiently long filename during a FTP LIST command resulting in overwriting the exception handler. Social engineering of executing a specially crafted ftp file by double click...

Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow

This module exploits a vulnerability found in Adobe Flash Player's Flash10u.ocx component. When processing a MP4 file specifically the Sequence Parameter Set, Flash will see if picordercnttype is equal to 1, which sets the numrefframesinpicordercntcycle field, and then blindly copies data in...

Windows Executable Download and Evaluate VBS

Downloads a file from an HTTPS URL and executes it as a vbs script. Use it to stage a vbs encoded payload from a short command line. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize =...

Oracle RDBMS Login Utility

This module attempts to authenticate against an Oracle RDBMS instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. Due to a bug in nmap versions 6.50-7.80 may not work. This module requires Metasploit: https://metasploit.com/download...

MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow

This module exploits a stack buffer overflow vulnerability in the handling of the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft, the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as well as Office 2004 for Mac, are vulnerable. NOTE: The vulnerable...

Hewlett-Packard Power Manager Administration Buffer Overflow

This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2. Sending a specially crafted POST request with an overly long Login string, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

SAP DB 7.4 WebTools Buffer Overflow

This module exploits a stack buffer overflow in SAP DB 7.4 WebTools. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Solaris LPD Arbitrary File Delete

This module uses a vulnerability in the Solaris line printer daemon to delete arbitrary files on an affected system. This can be used to exploit the rpc.walld format string flaw, the missing krb5.conf authentication bypass, or simply delete system files. Tested on Solaris 2.6, 7, 8, 9, and 10. Th...

MS02-056 Microsoft SQL Server Hello Overflow

By sending malformed data to TCP port 1433, an unauthenticated remote attacker could overflow a buffer and possibly execute code on the server with SYSTEM level privileges. This module should work against any vulnerable SQL Server 2000 or MSDE install 'MS02-056 Microsoft SQL Server Hello Overflow...

Minishare 1.4.1 Buffer Overflow

This is a simple buffer overflow for the minishare web server. This flaw affects all versions prior to 1.4.2. This is a plain stack buffer overflow that requires a "jmp esp" to reach the payload, making this difficult to target many platforms at once. This module has been successfully tested...

SlimFTPd LIST Concatenation Overflow

This module exploits a stack buffer overflow in the SlimFTPd server. The flaw is triggered when a LIST command is received with an overly-long argument. This vulnerability affects all versions of SlimFTPd prior to 3.16 and was discovered by Raphael Rigo. This module requires Metasploit:...

FTP Fetch, Hidden Bind TCP Stager

Fetch and execute an x86 payload from an FTP server. Listen for a connection from a hidden port and spawn a command shell to the allowed host. Module Options...

TFTP Fetch, Linux dup2 Command Shell, Bind TCP Stager

Fetch and execute an RISC-V 32-bit payload from a TFTP server. dup2 socket in s1, then execve. Listen for a connection Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTPS Stager (winhttp)

Fetch and execute an x64 payload from an FTP server. Custom shellcode stage. Tunnel communication over HTTPS Windows x64 winhttp Module Options...

FTP Fetch, Windows x64 LoadLibrary Path

Fetch and execute an x64 payload from an FTP server. Load an arbitrary x64 library path Module Options...

FTP Fetch, Windows shellcode stage, Windows x64 IPv6 Bind TCP Stager with UUID Support

Fetch and execute an x64 payload from an FTP server. Custom shellcode stage. Listen for an IPv6 connection with UUID Support Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

HTTPS Fetch, Linux dup2 Command Shell, Bind TCP Stager

Fetch and execute an RISC-V 32-bit payload from an HTTPS server. dup2 socket in s1, then execve. Listen for a connection Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

HTTPS Fetch, Linux dup2 Command Shell, Reverse TCP Stager

Fetch and execute an RISC-V 64-bit payload from an HTTPS server. dup2 socket in s1, then execve. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

FTP Fetch, Linux Command Shell, Reverse TCP Inline

Fetch and execute an RISC-V 64-bit payload from an FTP server. Connect back to attacker and spawn a command shell. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Reverse TCP Stager (IPv6)

Fetch and execute a x86 payload from an FTP server. Connect back to attacker over IPv6 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP...

FTP Fetch, Linux Read File

Fetch and execute a x86 payload from an FTP server. Read up to 4096 bytes from the local file system and write it back out to the specified file descriptor Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewor...

HTTP Fetch, Linux dup2 Command Shell, Reverse TCP Stager

Fetch and execute an RISC-V 32-bit payload from an HTTP server. dup2 socket in s1, then execve. Connect back to the attacker Module Options...

FTP Fetch, Linux x64 Pingback, Reverse TCP Inline

Fetch and execute an x64 payload from an FTP server. Connect back to attacker and report UUID Linux x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux Command Shell, Bind TCP Inline

Fetch and execute an MIPSBE payload from an FTP server. Listen for a connection and spawn a command shell Module Options msf use payload/cmd/linux/ftp/mipsbe/shellbindtcp msf payloadshellbindtcp show actions ...actions... msf payloadshellbindtcp set ACTION msf payloadshellbindtcp show options...

FTP Fetch, Linux Command Shell, Bind TCP Random Port Inline

Fetch and execute a x86 payload from an FTP server. Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: 'nmap -sS target -p-'. Module Options This module requires Metasploit: https://metasploit.com/download Current source:...

FTP Fetch, Reverse TCP Stager

Fetch and execute a x86 payload from an FTP server. Connect back to the attacker Module Options...

FTP Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)

Fetch and execute a x86 payload from an FTP server. Spawn a command shell staged. Listen for a connection with UUID Support Linux x86 Module Options...

FTP Fetch, Linux Execute Command

Fetch and execute an ARMLE payload from an FTP server. Execute an arbitrary command or just a /bin/sh shell Module Options msf use payload/cmd/linux/ftp/armle/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options ...show and set options... msf...

FTP Fetch, Linux Add User

Fetch and execute an ARMLE payload from an FTP server. Create a new user with UID 0 Module Options msf use payload/cmd/linux/ftp/armle/adduser msf payloadadduser show actions ...actions... msf payloadadduser set ACTION msf payloadadduser show options ...show and set options... msf payloadadduser...

XOR Encoder with Cipher Feedback

Dword XOR encoder with cipher feedback for RISC-V 64-bit Little Endian. Each dword is XORed with the previous encoded dword rather than a static key, creating a chained dependency that makes the output more resistant to frequency analysis. The first dword is XORed with the key to bootstrap the...

XOR Encoder with Cipher Feedback

Dword XOR encoder with cipher feedback for RISC-V 32-bit Little Endian. Each dword is XORed with the previous encoded dword rather than a static key, creating a chained dependency that makes the output more resistant to frequency analysis. The first dword is XORed with the key to bootstrap the...

Windows shellcode stage, Hidden Bind Ipknock TCP Stager

Custom shellcode stage. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket will appear as "closed," thu...