7325 matches found
Windows Interactive Powershell Session, Bind TCP
Interacts with a powershell session on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include Msf::Payload::Sing...
Android Browser File Theft
This module steals the cookie, password, and autofill databases from the Browser application on AOSP 4.3 and below. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Browser File Theft',...
D-Link Devices HNAP SOAPAction-Header Command Execution
Different D-Link Routers are vulnerable to OS command injection in the HNAP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested on a DIR-645 device. The following devices are also reported as affected:...
ManageEngine Multiple Products Arbitrary File Download
This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This module will attempt to login using th...
IPass Control Pipe Remote Command Execution
This module exploits a vulnerability in the IPass Client service. This service provides a named pipe which can be accessed by the user group BUILTIN\Users. This pipe can be abused to force the service to load a DLL from a SMB share. Module Options msf use exploit/windows/smb/ipass/pipeexec msf...
VNC Server (Reflective Injection), Hidden Bind Ipknock TCP Stager
Inject a VNC Dll via a reflective loader staged. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket wil...
ManageEngine Desktop Central StatusUpdate Arbitrary File Upload
This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 including the MSP versions. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version ...
ActualAnalyzer 'ant' Cookie Command Execution
This module exploits a command execution vulnerability in ActualAnalyzer version 2.81 and prior. The 'aa.php' file allows unauthenticated users to execute arbitrary commands in the 'ant' cookie. Module Options msf use exploit/unix/webapp/actualanalyzer/antcookieexec msf undefinedantcookieexec sho...
Joomla Bruteforce Login Utility
This module attempts to authenticate to Joomla 2.5. or 3.0 through bruteforce attacks This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Joomla Bruteforce Login Utility', 'Description' = 'This...
Supermicro Onboard IPMI close_window.cgi Buffer Overflow
This module exploits a buffer overflow on the Supermicro Onboard IPMI controller web interface. The vulnerability exists on the closewindow.cgi CGI application, and is due to the insecure usage of strcpy. In order to get a session, the module will execute system from libc with an arbitrary CMD...
HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload
This module exploits a path traversal flaw in the HP ProCurve Manager SNAC Server. The vulnerability in the UpdateDomainControllerServlet allows an attacker to upload arbitrary files, just having into account binary writes aren't allowed. Additionally, authentication can be bypassed in order to...
ABB MicroSCADA wserver.exe Remote Code Execution
This module exploits a remote stack buffer overflow vulnerability in ABB MicroSCADA. The issue is due to the handling of unauthenticated EXECUTE operations on the wserver.exe component, which allows arbitrary commands. The component is disabled by default, but required when a project uses the SCI...
Unix Command Shell, Double Reverse TCP SSL (telnet)
Creates an interactive shell through two inbound connections, encrypts using SSL via "-z" option This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 136 include Msf::Payload::Single...
Linksys WRT54GL apply.cgi Command Execution
Some Linksys Routers are vulnerable to an authenticated OS command injection in the Web Interface. Default credentials are admin/admin or admin/password. Since it is a blind os command injection vulnerability, there is no output for the executed command when using the cmd generic payload. A ping...
PHP-Charts v1.0 PHP Code Execution Vulnerability
This module exploits a PHP code execution vulnerability in php-Charts version 1.0 which could be abused to allow users to execute arbitrary PHP code under the context of the webserver user. The 'url.php' script calls eval with user controlled data from any HTTP GET parameter name. Module Options...
Ruby Command Shell, Bind TCP IPv6
Continually listen for a connection and spawn a command shell via Ruby This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 524 include Msf::Payload::Single include Msf::Payload::Ruby...
Ruby Command Shell, Reverse TCP
Connect back and create a command shell via Ruby This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 516 include Msf::Payload::Single include Msf::Payload::Ruby include...
Oracle MySQL for Microsoft Windows FILE Privilege Abuse
This module takes advantage of a file privilege misconfiguration problem specifically against Windows MySQL servers. This module abuses the FILE privilege to write a payload to Microsoft's All Users Start Up directory which will execute every time a user logs in. The default All Users Start Up...
Windows Gather Database Instance Enumeration
This module will enumerate a windows system for installed database instances This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Database Instance Enumeration', 'Description' = %q Th...
PcAnywhere Login Scanner
This module will test pcAnywhere logins on a range of machines and report successful logins. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PcAnywhere Login Scanner', 'Description' = %q This...
Schneider Modicon Ladder Logic Upload/Download
The Schneider Modicon with Unity series of PLCs use Modbus function code 90 0x5a to send and receive ladder logic. The protocol is unauthenticated, and allows a rogue host to retrieve the existing logic and to upload new logic. Two modes are supported: "SEND" and "RECV," which behave as one might...
IBM Personal Communications iSeries Access WorkStation 5.9 Profile
The IBM Personal Communications I-Series application WorkStation is susceptible to a stack-based buffer overflow vulnerability within file parsing in which data copied to a location in memory exceeds the size of the reserved destination area. The buffer is located on the runtime program stack. Wh...
Linux Command Shell, Reverse TCP Inline
Connect to target and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 208 include Msf::Payload::Single include Msf::Payload::Linux::Armle::Prepends include...
Windows Disconnect Wireless Connection
This module disconnects the current wireless network connection on the specified interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Disconnect Wireless Connection', 'Description...
Windows Gather Enumerate Computers
This module will enumerate computers included in the primary Active Directory domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Enumerate Computers', 'Description' = %q Thi...
SAP Management Console Get Process Parameters
This module simply attempts to output a SAP process parameters and configuration settings through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP...
Cross Platform Webkit File Dropper
This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\ This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework cla...
Windows Manage Process Migration
This module will migrate a Meterpreter session from one process to another. A given process PID to migrate to or the module can spawn one and migrate to that newly spawned process. This module requires Metasploit: https://metasploit.com/download Current source:...
Oracle iSQL*Plus Login Utility
This module attempts to authenticate against an Oracle ISQLPlus administration web site using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE. This module does not require a valid SID, but if one is defined, it will be used. Works against Oracle 9.2, 10.1 ...
Windows Escalate Locked Desktop Unlocker
This module unlocks a locked Windows desktop by patching the respective code inside the LSASS.exe process. This patching process can result in the target system hanging or even rebooting, so be careful when using this module on production systems. This module requires Metasploit:...
Microsoft SQL Server Interesting Data Finder
This module will search the specified MSSQL server for 'interesting' columns and data. This module has been tested against the latest SQL Server 2019 docker container image 22/04/2021. This module requires Metasploit: https://metasploit.com/download Current source:...
JBoss JMX Console Beanshell Deployer WAR Upload and Deployment
This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. Module Options msf use exploit/multi/http/jboss/bshdeployer msf...
Trellian FTP Client 3.01 PASV Remote Buffer Overflow
This module exploits a buffer overflow in the Trellian 3.01 FTP client that is triggered through an excessively long PASV message. Module Options msf use exploit/windows/ftp/trellian/clientpasv msf undefinedclientpasv show actions ...actions... msf undefinedclientpasv set ACTION msf...
CA eTrust PestPatrol ActiveX Control Buffer Overflow
This module exploits a stack buffer overflow in CA eTrust PestPatrol. When sending an overly long string to the Initialize property of ppctl.dll 5.6.7.9 an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...
Oracle DB SQL Injection via SYS.LT.MERGEWORKSPACE
This module exploits a sql injection flaw in the MERGEWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. This module requires Metasploit: https://metasploit.com/download Current source:...
PHP Executable Download and Execute
Download an EXE from an HTTP URL and execute it This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Php include Msf::Payload::Single def initializeinfo =...
Guild FTPd 0.999.8.11/0.999.14 Heap Corruption
Guild FTPd 0.999.8.11 and 0.999.14 are vulnerable to heap corruption. You need to have a valid login so you can run CWD and LIST. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Guild FTPd...
DATAC RealWin SCADA Server Buffer Overflow
This module exploits a stack buffer overflow in DATAC Control International RealWin SCADA Server 2.0 Build 6.0.10.37. By sending a specially crafted FCINFOTAG/SETCONTROL packet, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download...
Wireshark LDAP Dissector DOS
The LDAP dissector in Wireshark 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service application crash via a malformed packet. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModu...
BigAnt Server 2.2 Buffer Overflow
This module exploits a stack buffer overflow in BigAnt Server 2.2. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...
Windows Command, Double Reverse TCP Connection (via Perl)
Creates an interactive shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 148 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo...
Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow
This module exploits a stack buffer overflow in the ISAlertDataCOM ActiveX Control ISLAert.dll provided by Symantec Norton Internet Security 2004. By sending an overly long string to the "Get" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...
Icecast Header Overwrite
This module exploits a buffer overflow in the header parsing of icecast versions 2.0.1 and earlier, discovered by Luigi Auriemma. Sending 32 HTTP headers will cause a write one past the end of a pointer array. On win32 this happens to overwrite the saved instruction pointer, and on linux dependin...
MS04-011 Microsoft Private Communications Transport Overflow
This module exploits a buffer overflow in the Microsoft Windows SSL PCT protocol stack. This code is based on Johnny Cyberpunk's THC release and has been tested against Windows 2000 and Windows XP. To use this module, specify the remote port of any SSL service, or the port and protocol of an...
FTP Fetch, Reverse TCP Stager (RC4 Stage Encryption, Metasm)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP includ...
FTP Fetch, Reverse TCP Stager (IPv6)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker over IPv6 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include...
FTP Fetch, Reverse TCP Stager (No NX or Win7)
Fetch and execute an x86 payload from an FTP server. Connect back to the attacker No NX Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule include Msf::Payload::Adapter::Fetch::FTP...
FTP Fetch, Windows shellcode stage, Reverse TCP Stager with UUID Support (Windows x64)
Fetch and execute an x64 payload from an FTP server. Custom shellcode stage. Connect back to the attacker with UUID Support Windows x64 Module Options This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...