FTP Fetch, Windows shellcode stage, Windows x64 Reverse HTTP Stager (wininet)

Fetch and execute an x64 payload from an FTP server. Custom shellcode stage. Tunnel communication over HTTP Windows x64 wininet Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

FTP Fetch

Fetch and execute an x64 payload from an FTP server. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP include...

FTP Fetch, Linux x64 Command Shell, Reverse TCP Inline (IPv6)

Fetch and execute an x64 payload from an FTP server. Connect back to attacker and spawn a command shell over IPv6 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

HTTPS Fetch

Fetch and execute a script to determine the host arch and execute a payload from an HTTPS server. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux Execute Command

Fetch and execute an RISC-V 32-bit payload from an FTP server. Execute an arbitrary command Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch

Fetch and execute an x64 payload from an FTP server. Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP include...

FTP Fetch, Linux Execute Command

Fetch and execute an MIPSLE payload from an FTP server. A very small shellcode for executing commands. This module is sometimes helpful for testing purposes as well as on targets with extremely limited buffer space. Module Options msf use payload/cmd/linux/ftp/mipsle/exec msf payloadexec show...

FTP Fetch, Linux Execute Command

Fetch and execute a x86 payload from an FTP server. Execute an arbitrary command or just a /bin/sh shell Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux Command Shell, Reverse TCP Stager

Fetch and execute an MIPSLE payload from an FTP server. Spawn a command shell staged. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux Chmod

Fetch and execute a x86 payload from an FTP server. Runs chmod on specified file with specified mode Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...

FTP Fetch, Linux dup2 Command Shell, Bind TCP Stager

Fetch and execute an RISC-V 64-bit payload from an FTP server. dup2 socket in s1, then execve. Listen for a connection Module Options...

FTP Fetch, Linux Command Shell, Find Port Inline

Fetch and execute an x64 payload from an FTP server. Spawn a shell on an established connection Module Options...

FTP Fetch, Linux Add User

Fetch and execute a x86 payload from an FTP server. Create a new user with UID 0 Module Options...

FTP Fetch, Linux x64 Pingback, Bind TCP Inline

Fetch and execute an x64 payload from an FTP server. Accept a connection from attacker and report UUID Linux x64 Module Options...

FTP Fetch

Fetch and execute an MIPSBE payload from an FTP server. Module Options msf use payload/cmd/linux/ftp/mipsbe/meterpreterreversetcp msf payloadmeterpreterreversetcp show actions ...actions... msf payloadmeterpreterreversetcp set ACTION msf payloadmeterpreterreversetcp show options ...show and set...

FTP Fetch, Reverse TCP Stager

Fetch and execute an ARMLE payload from an FTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/ftp/armle/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set...

Windows shellcode stage, Reverse HTTP Stager Proxy

Custom shellcode stage. Tunnel communication over HTTP Module Options msf use payload/windows/custom/reversehttpproxypstore msf payloadreversehttpproxypstore show actions ...actions... msf payloadreversehttpproxypstore set ACTION msf payloadreversehttpproxypstore show options ...show and set...

Windows shellcode stage, Hidden Bind TCP Stager

Custom shellcode stage. Listen for a connection from a hidden port and spawn a command shell to the allowed host. Module Options msf use payload/windows/custom/bindhiddentcp msf payloadbindhiddentcp show actions ...actions... msf payloadbindhiddentcp set ACTION msf payloadbindhiddentcp show optio...

Redis Extractor

This module connects to a Redis instance and retrieves keys and data stored. Module Options msf use auxiliary/gather/redisextractor msf auxiliaryredisextractor show actions ...actions... msf auxiliaryredisextractor set ACTION msf auxiliaryredisextractor show options ...show and set options... msf...

Windows Manage Volume Shadow Copies

This module will perform management actions for Volume Shadow Copies on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later. Module Options msf use post/windows/manage/vss msf postvss show actions ...actions... msf postvss set...

ThinVNC Directory Traversal

This module exploits a directory traversal vulnerability in ThinVNC versions 1.0b1 and prior which allows unauthenticated users to retrieve arbitrary files, including the ThinVNC configuration file. This module has been tested successfully on ThinVNC versions 1.0b1 and "ThinVNCLatest" 2018-12-07...

Phpmyadmin credentials stealer

This module gathers Phpmyadmin creds from target linux machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Phpmyadmin credentials stealer', 'Description' = %q This module gathers Phpmyadmi...

Linux Meterpreter, Reverse HTTPS Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 1516524 include...

OSX Meterpreter, Reverse TCP Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 815032 include...

Polycom Shell HDX Series Traceroute Command Execution

Within Polycom command shell, a command execution flaw exists in lan traceroute, one of the dev commands, which allows for an attacker to execute arbitrary payloads with telnet or openssl. Module Options msf use exploit/unix/misc/polycom/hdxtracerouteexec msf undefinedhdxtracerouteexec show actio...

Kaltura Remote PHP Code Execution over Cookie

This module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura makes use of a hardcoded cookie secret which allows to sign arbitrary cookie data. After passing...

Linux Meterpreter, Reverse TCP Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 1068952 include...

Apache Struts 2 Struts 1 Plugin Showcase OGNL Code Execution

This module exploits a remote code execution vulnerability in the Struts Showcase app in the Struts 1 plugin example in Struts 2.3.x series. Remote Code Execution can be performed via a malicious field value. Module Options msf use exploit/multi/http/struts2/codeexecshowcase msf...

Get the Vehicle Information Such as the VIN from the Target Module

Post Module to query DTCs, Some common engine info and Vehicle Info. It returns such things as engine speed, coolant temp, Diagnostic Trouble Codes as well as All info stored by Mode $09 Vehicle Info, VIN, etc This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Gather MDaemonEmailServer Credential Cracking

Finds and cracks the stored passwords of MDaemon Email Server This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'base64' class MetasploitModule 'Windows Gather MDaemonEmailServer Credential Cracking',...

Generic JCL Test for Mainframe Exploits

Provide JCL which can be used to submit a job to JES2 on z/OS which will exit and return 0. This can be used as a template for other JCL based payloads This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This is a prototy...

ATutor 2.2.1 SQL Injection / Remote Code Execution

This module exploits a SQL Injection vulnerability and an authentication weakness vulnerability in ATutor. This essentially means an attacker can bypass authentication and reach the administrator's interface where they can upload malicious code. Module Options msf use exploit/multi/http/atutor/sq...

Vtiger CRM - Authenticated Logo Upload RCE

Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This module was tested against vTiger CRM v6.3.0. Module Options m...

ManageEngine EventLog Analyzer Remote Code Execution

This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6 build 10060 and previous versions. Every authenticated user, including the default "guest" account can execute SQL queries directly on the underlying Postgres database server. The queries are executed as the...

Watchguard XCS Remote Command Execution

This module exploits two separate vulnerabilities found in the Watchguard XCS virtual appliance to gain command execution. By exploiting an unauthenticated SQL injection, a remote attacker may insert a valid web user into the appliance database, and get access to the web interface. On the other...

Android Screen Capture

This module takes a screenshot of the target phone. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Screen Capture', 'Description' = %q This module takes a screenshot of the target phon...

Windows Interactive Powershell Session, Bind TCP

Interacts with a powershell session on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include Msf::Payload::Sing...

Adobe Flash Player NetConnection Type Confusion

This module exploits a type confusion vulnerability in the NetConnection class on Adobe Flash Player. When using a correct memory layout this vulnerability allows to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like vectors, and ultimately accomplish remote code...

Android Browser File Theft

This module steals the cookie, password, and autofill databases from the Browser application on AOSP 4.3 and below. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Browser File Theft',...

D-Link Devices HNAP SOAPAction-Header Command Execution

Different D-Link Routers are vulnerable to OS command injection in the HNAP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested on a DIR-645 device. The following devices are also reported as affected:...

ManageEngine Multiple Products Arbitrary File Download

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...

IPass Control Pipe Remote Command Execution

This module exploits a vulnerability in the IPass Client service. This service provides a named pipe which can be accessed by the user group BUILTIN\Users. This pipe can be abused to force the service to load a DLL from a SMB share. Module Options msf use exploit/windows/smb/ipass/pipeexec msf...

VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager

Inject a VNC Dll via a reflective loader staged. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket wil...

BMC TrackIt! Unauthenticated Arbitrary User Password Change

This module exploits a flaw in the password reset mechanism in BMC TrackIt! 11.3 and possibly prior versions. If the password reset service is configured to use a domain administrator which is the recommended configuration, then domain credentials can be reset such as domain Administrator. Module...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 including the MSP versions. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version ...

ActualAnalyzer 'ant' Cookie Command Execution

This module exploits a command execution vulnerability in ActualAnalyzer version 2.81 and prior. The 'aa.php' file allows unauthenticated users to execute arbitrary commands in the 'ant' cookie. Module Options msf use exploit/unix/webapp/actualanalyzer/antcookieexec msf undefinedantcookieexec sho...

Joomla Bruteforce Login Utility

This module attempts to authenticate to Joomla 2.5. or 3.0 through bruteforce attacks This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Joomla Bruteforce Login Utility', 'Description' = 'This...

MongoDB NoSQL Collection Enumeration Via Injection

This module can exploit NoSQL injections on MongoDB versions less than 2.4 and enumerate the collections available in the data via boolean injections. Module Options msf use auxiliary/gather/mongodb/jsinjectcollectionenum msf undefinedjsinjectcollectionenum show actions ...actions... msf...

Linux Reboot

A very small shellcode for rebooting the system. This payload is sometimes helpful for testing purposes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 32 include...

Supermicro Onboard IPMI close_window.cgi Buffer Overflow

This module exploits a buffer overflow on the Supermicro Onboard IPMI controller web interface. The vulnerability exists on the closewindow.cgi CGI application, and is due to the insecure usage of strcpy. In order to get a session, the module will execute system from libc with an arbitrary CMD...