Dword XOR Encoder (Tag-based)

Dword XOR encoder for RISC-V 64-bit Little Endian using a tag-based terminator rather than an encoded length. The decoder loop XORs each dword and stops when the result is zero the sentinel. This avoids encoding the payload length in the stub, eliminating a source of bad character conflicts. Note...

Native LDAP Server (Example)

This module provides a Rex based LDAP service to expose the native Rex LDAP server functionality created during log4shell development. Module Options msf use auxiliary/server/ldap msf auxiliaryldap show actions ...actions... msf auxiliaryldap set ACTION msf auxiliaryldap show options ...show and...

Windows x86 Pingback, Bind TCP Inline

Open a socket and report UUID when a connection is received Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 314 include Msf::Payload::Windows include Msf::Payload::Sing...

CMS Made Simple (CMSMS) Showtime2 File Upload RCE

This module exploits a File Upload vulnerability that lead in a RCE in Showtime2 module use exploit/multi/http/cmsms/showtime2rce msf undefinedshowtime2rce show actions ...actions... msf undefinedshowtime2rce set ACTION msf undefinedshowtime2rce show options ...show and set options... msf...

Baldr Botnet Panel Shell Upload Exploit

This module exploits an arbitrary file upload vulnerability within the Baldr stealer malware control panel when uploading victim log files which are uploaded as ZIP files. Attackers can turn this vulnerability into an RCE by first registering a new bot to the panel and then uploading a ZIP file...

Solaris libnspr NSPR_LOG_FILE Privilege Escalation

This module exploits an arbitrary file write vulnerability in the Netscape Portable Runtime library libnspr on unpatched Solaris systems prior to Solaris 10u3 which allows users to gain root privileges. libnspr versions prior to 4.6.3 allow users to specify a log file with the NSPRLOGFILE...

WebKitGTK+ WebKitFaviconDatabase DoS

This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset. If successful, it could lead to application crash, resulting in denial of service. Module Options msf use auxiliary/dos/http/webkitplus msf undefinedwebkitplus show actions ...actions... msf undefinedwebkitplus s...

Apple_iOS Meterpreter, Reverse HTTPS Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 796904 include...

Linux Meterpreter, Reverse TCP Inline

Run the Meterpreter / Mettle server payload stageless This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Module generated by tools/modules/generatemettlepayloads.rb module MetasploitModule CachedSize = 1140752 include...

IBM Notes encodeURI DOS

This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If successful, it could cause the Notes client to hang and have to be restarted. Module Options msf use auxiliary/dos/http/ibm/lotusnotes msf undefinedlotusnotes show actions ...actions... msf...

Western Digital MyCloud multi_uploadify File Upload Vulnerability

This module exploits a file upload vulnerability found in Western Digital's MyCloud NAS web administration HTTP service. The /web/jquery/uploader/multiuploadify.php PHP script provides multipart upload functionality that is accessible without authentication and can be used to place a file anywher...

Python Meterpreter Shell, Reverse TCP Inline

Connect back to the attacker and spawn a Meterpreter shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Python includ...

WinRM Command Runner

This module runs arbitrary Windows commands using the WinRM Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/winrm/connection' class MetasploitModule 'WinRM Command Runner', 'Description' = %q This...

Jenkins CLI Deserialization

An unauthenticated Java object deserialization vulnerability exists in the CLI component for Jenkins versions v2.56 and below. The readFrom method within the Command class in the Jenkins CLI remoting component deserializes objects received from clients without first checking / sanitizing the data...

Sends Beacons to Scan for Active ZigBee Networks

Post Module to send beacon signals to the broadcast address while channel hopping This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sends Beacons to Scan for Active ZigBee Networks', 'Description...

Jboss Credential Collector

This module can be used to extract the Jboss admin passwords for version 4,5 and 6. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'Jboss Credential Collector', 'Description'...

Disk Savvy Enterprise v10.4.18

This module exploits a stack-based buffer overflow vulnerability in Disk Savvy Enterprise v10.4.18, caused by improper bounds checking of the request sent to the built-in server. This module has been tested successfully on Windows 7 SP1 x86. Module Options msf use exploit/windows/misc/disk/savvya...

Hardware Bridge Session Connector

The Hardware Bridge HWBridge is a standardized method for Metasploit to interact with Hardware Devices. This extends the normal exploit capabilities to the non-ethernet realm and enables direct hardware and alternative bus manipulations. You must have compatible bridging hardware attached to this...

ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability found in ColoradoFTP server version use auxiliary/scanner/ftp/colorado/ftptraversal msf undefinedftptraversal show actions ...actions... msf undefinedftptraversal set ACTION msf undefinedftptraversal show options ...show and set options...

DLL Side Loading Vulnerability in VMware Host Guest Client Redirector

A DLL side loading vulnerability was found in the VMware Host Guest Client Redirector, a component of VMware Tools. This issue can be exploited by luring a victim into opening a document from the attacker's share. An attacker can exploit this issue to execute arbitrary code with the privileges of...

Nagios XI Chained Remote Code Execution

This module exploits an SQL injection, auth bypass, file upload, command injection, and privilege escalation in Nagios XI use exploit/linux/http/nagios/xichainedrce msf undefinedxichainedrce show actions ...actions... msf undefinedxichainedrce set ACTION msf undefinedxichainedrce show options...

Ruby on Rails ActionPack Inline ERB Code Execution

This module exploits a remote code execution vulnerability in the inline request processor of the Ruby on Rails ActionPack component. This vulnerability allows an attacker to process ERB to the inline JSON processor, which is then rendered, permitting full RCE within the runtime, without logging ...

BusyBox Jailbreak

This module will send a set of commands to an open session that is connected to a BusyBox limited shell i.e. a router limited shell. It will try different known tricks to jailbreak the limited shell and get a full BusyBox shell. This module requires Metasploit: https://metasploit.com/download...

Heroes of Might and Magic III .h3m Map file Buffer Overflow

This module embeds an exploit into an uncompressed map file .h3m for Heroes of Might and Magic III. Once the map is started in-game, a buffer overflow occurring when loading object sprite names leads to shellcode execution. Module Options msf use exploit/windows/fileformat/homm3/h3m msf...

Load Scripts Into PowerShell Session

This module will download and execute one or more PowerShell scripts over a present powershell session. Setting VERBOSE to true will show the stager results. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Windows Interactive Powershell Session, Reverse TCP

Interacts with a powershell session on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include Msf::Payload::Sing...

ManageEngine Desktop Central Login Utility

This module will attempt to authenticate to a ManageEngine Desktop Central. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/manageenginedesktopcentral' require...

SSH Public Key Acceptance Scanner

This module can determine what public keys are configured for key-based authentication across a range of machines, users, and sets of known keys. The SSH protocol indicates whether a particular key is accepted prior to the client performing the actual signed authentication request. To use this...

MS14-070 Windows tcpip!SetAddrOptions NULL Pointer Dereference

A vulnerability within the Microsoft TCP/IP protocol driver tcpip.sys can allow a local attacker to trigger a NULL pointer dereference by using a specially crafted IOCTL. This flaw can be abused to elevate privileges to SYSTEM. Module Options msf use exploit/windows/local/ms14/070tcpipioctl msf...

Android Open Source Platform (AOSP) Browser UXSS

This module exploits a Universal Cross-Site Scripting UXSS vulnerability present in all versions of Android's open source stock browser before 4.4, and Android apps running on use auxiliary/gather/android/objecttagwebviewuxss msf undefinedobjecttagwebviewuxss show actions ...actions... msf...

ARRIS / Motorola SBG6580 Cable Modem SNMP Enumeration Module

This module allows SNMP enumeration of the ARRIS / Motorola SURFboard SBG6580 Series Wi-Fi Cable Modem Gateway. It supports the username and password for the device user interface as well as wireless network keys and information. The default community used is "public". This module requires...

HybridAuth install.php PHP Code Execution

This module exploits a PHP code execution vulnerability in HybridAuth versions 2.0.9 to 2.2.2. The install file 'install.php' is not removed after installation allowing unauthenticated users to write PHP code to the application configuration file 'config.php'. Note: This exploit will overwrite th...

Multi Manage DbVisualizer Add Db Admin

Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases With GUI. The remote database can be accessed from the command line without the need to authenticate, which can be abused to create an administrator in the database with the proper database permissions. Note:...

Firefox XSS

This module runs the provided SCRIPT as javascript in the origin of the provided URL. It works by navigating to a hidden ChromeWindow to the URL, then injecting the SCRIPT with Function. The callback "sendresult" is used to send data back to the listener. This module requires Metasploit:...

HP Client Automation Command Injection

This module exploits a command injection vulnerability on HP Client Automation, distributed actually as Persistent Systems Client Automation. The vulnerability exists in the Notify Daemon radexecd.exe, which doesn't authenticate execution requests by default. This module has been tested...

OSX Gather Autologin Password as Root

This module will steal the plaintext password of any user on the machine with autologin enabled. Root access is required. When a user has autologin enabled System Preferences - Accounts, OSX stores their password with an XOR encoding in /private/etc/kcpassword. This module requires Metasploit:...

Gzip Memory Bomb Denial Of Service

This module generates and hosts a 10MB single-round gzip file that decompresses to 10GB. Many applications will not implement a length limit check and will eat up all memory and eventually die. This can also be used to kill systems that download/parse content from a user-provided URL...

Command Shell, Reverse TCP (via nodejs)

Creates an interactive shell via nodejs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework It would be better to have a commonjs payload, but because the implementations differ so greatly when it comes to require paths f...

D-Link DIR-615H HTTP Login Utility

This module attempts to authenticate to different D-Link HTTP management services. It has been tested successfully on D-Link DIR-615 Hardware revision H devices. It is possible that this module also works with other models. This module requires Metasploit: https://metasploit.com/download Current...

HP Intelligent Management Center Arbitrary File Upload

This module exploits a code execution flaw in HP Intelligent Management Center. The vulnerability exists in the mibFileUpload which is accepting unauthenticated file uploads and handling zip contents in an insecure way. Combining both weaknesses a remote attacker can accomplish arbitrary file...

Unix Command Shell, Reverse TCP SSL (via php)

Creates an interactive shell via php, uses SSL This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 279 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

Linksys WRT54GL apply.cgi Command Execution

Some Linksys Routers are vulnerable to an authenticated OS command injection in the Web Interface. Default credentials are admin/admin or admin/password. Since it is a blind os command injection vulnerability, there is no output for the executed command when using the cmd generic payload. A ping...

Mutiny Remote Command Execution

This module exploits an authenticated command injection vulnerability in the Mutiny appliance. Versions prior to 4.5-1.12 are vulnerable. In order to exploit the vulnerability the mutiny user must have access to the admin interface. The injected commands are executed with root privileges. This...

Avoid underscore/tolower

Underscore/tolower Safe Encoder used to exploit CVE-2012-2329. It is a modified version of the 'Avoid UTF8/tolower' encoder by skape. Please check the documentation of the skape encoder before using it. As the original, this encoder expects ECX pointing to the start of the encoded payload. Also...

OS X Gather Chicken of the VNC Profile

This module will download the "Chicken of the VNC" client application's profile file, which is used to store other VNC servers' information such as the IP and password. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

RabidHamster R4 Log Entry sprintf() Buffer Overflow

This module exploits a vulnerability found in RabidHamster R4's web server. By supplying a malformed HTTP request, it is possible to trigger a stack-based buffer overflow when generating a log, which may result in arbitrary code execution under the context of the user. Module Options msf use...

PHP Command Shell, Bind TCP (via perl) IPv6

Listen for a connection and spawn a command shell via perl persistent over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include...

MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability

This module exploits a vulnerability found in Microsoft Office's ClickOnce feature. When handling a Macro document, the application fails to recognize certain file extensions as dangerous executables, which can be used to bypass the warning message. This can allow attackers to trick victims into...

CorpWatch Company ID Information Search

This module interfaces with the CorpWatch API to get publicly available info for a given CorpWatch ID of the company. If you don't know the CorpWatch ID, please use the corpwatchlookupname module first. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Gather Privileges Enumeration

This module will print if UAC is enabled, and if the current account is ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status and current process PRIVILEGES. This module requires Metasploit: https://metasploit.com/download Current source:...