Modbus Client Utility

This module allows reading and writing data to a PLC using the Modbus protocol. This module is based on the 'modiconstop.rb' Basecamp module from DigitalBond, as well as the mbtget perl script. This module requires Metasploit: https://metasploit.com/download Current source:...

OS X Gather Mac OS X Password Hash Collector

This module dumps SHA-1, LM, NT, and SHA-512 Hashes on OSX. Supports versions 10.3 to 10.14. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'OS X Gather Mac OS X Passwo...

Samba read_nttrans_ea_list Integer Overflow

Integer overflow in the readnttransealist function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service memory consumption via a malformed packet. Important Note: in order to work, the "ea support" option o...

OSX Capture Userspace Keylogger

Logs all keyboard events except cmd-keys and GUI password input. Keylogs are transferred between client/server in chunks every SYNCWAIT seconds for reliability. Works by calling the Carbon GetKeys hook using the DL lib in OSX's system Ruby. The Ruby code is executed in a shell command using -e, s...

Windows Manage Set Port Forwarding With PortProxy

This module uses the PortProxy interface from netsh to set up port forwarding persistently even after reboot. PortProxy supports TCP IPv4 and IPv6 connections. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

OSX Manage Record Microphone

This module will allow the user to detect with the LIST action and capture with the RECORD action audio inputs on a remote OSX machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'shellwords' class...

OSX Manage Webcam

This module will allow the user to detect installed webcams with the LIST action, take a snapshot with the SNAPSHOT action, or record a webcam and mic with the RECORD action This module requires Metasploit: https://metasploit.com/download Current source:...

VMWare Setuid vmware-mount Unsafe popen(3)

VMWare Workstation up to and including 9.0.2 build-1031769 and Player have a setuid executable called vmware-mount that invokes lsbrelease in the PATH with popen3. Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an...

WordPress Brute Force and User Enumeration Utility

WordPress Authentication Brute Force and User Enumeration Utility This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Brute Force and User Enumeration Utility', 'Description' = 'WordPress...

Windows Gather Prefetch File Information

This module gathers prefetch file information from WinXP, Win2k3 and Win7 systems and current values of related registry keys. From each prefetch file we'll collect filetime converted to utc of the last execution, file path hash, run count, filename and the execution path. This module requires...

Graphite Web Unsafe Pickle Handling

This module exploits a remote code execution vulnerability in the pickle handling of the rendering code in the Graphite Web project between version 0.9.5 and 0.9.10 both included. Module Options msf use exploit/unix/webapp/graphite/pickleexec msf undefinedpickleexec show actions ...actions... msf...

freeFTPd PASS Command Buffer Overflow

freeFTPd 1.0.10 and below contains an overflow condition that is triggered as user-supplied input is not properly validated when handling a specially crafted PASS command. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or allow the execution of...

Nexpose XXE Arbitrary File Read

Nexpose v5.7.2 and prior is vulnerable to a XML External Entity attack via a number of vectors. This vulnerability can allow an attacker to a craft special XML that could read arbitrary files from the filesystem. This module exploits the vulnerability via the XML API. This module requires...

Cisco Ironport Bruteforce Login Utility

This module scans for Cisco Ironport SMA, WSA and ESA web login portals, finds AsyncOS versions, and performs login brute force to identify valid credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

OSX Password Prompt Spoof

Presents a password prompt dialog to a logged-in OSX user. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OSX Password Prompt Spoof', 'Description' = %q Presents a password prompt dialog to a...

Java storeImageArray() Invalid Array Indexing Vulnerability

This module abuses an Invalid Array Indexing Vulnerability on the static function storeImageArray function in order to cause a memory corruption and escape the Java Sandbox. The vulnerability affects Java version 7u21 and earlier. The module, which doesn't bypass click2play, has been tested...

Adobe Reader ToolButton Use After Free

This module exploits a use after free condition on Adobe Reader versions 11.0.2, 10.1.6 and 9.5.4 and prior. The vulnerability exists while handling the ToolButton object, where the cEnable callback can be used to early free the object memory. Later use of the object allows triggering the use aft...

Adobe Reader ToolButton Use After Free

This module exploits an use after free condition on Adobe Reader versions 11.0.2, 10.1.6 and 9.5.4 and prior. The vulnerability exists while handling the ToolButton object, where the cEnable callback can be used to early free the object memory. Later use of the object allows triggering the use...

Adobe ColdFusion RDS Authentication Bypass

Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to th...

OpenX Backdoor PHP Code Execution

OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013. Exploitation is simple, requiring only a single request with a rot13'd and reversed payload. Module Options msf use exploit/multi/http/openx/backdoorphp msf undefinedbackdoorph...

Python Meterpreter, Python Bind TCP Stager

Run a meterpreter server in Python compatible with 2.5-2.7 & 3.1+. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Stager...

Python Meterpreter, Python Reverse TCP Stager

Run a meterpreter server in Python compatible with 2.5-2.7 & 3.1+. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Stage...

Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution

On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given invalid input, would throw an exception that did not have an exposedProps property set. By re-setting this property on the exception object's prototype, the chrome-based defineProperty method is made available. With...

Squash YAML Code Execution

This module exploits a remote code execution vulnerability in the YAML request processor of the Squash application. Module Options msf use exploit/unix/webapp/squash/yamlexec msf undefinedyamlexec show actions ...actions... msf undefinedyamlexec set ACTION msf undefinedyamlexec show options ...sh...

Windows Gather DNS Cache

This module displays the records stored in the DNS cache. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather DNS Cache', 'Description' = %q This module displays the records stored i...

Agnitum Outpost Internet Security Local Privilege Escalation

This module exploits a directory traversal vulnerability on Agnitum Outpost Internet Security 8.1. The vulnerability exists in the acs.exe component, allowing the user to load arbitrary DLLs through the acsipcserver named pipe, and finally execute arbitrary code with SYSTEM privileges. This modul...

Joomla Media Manager File Upload Vulnerability

This module exploits a vulnerability found in Joomla 2.5.x up to 2.5.13, as well as 3.x up to 3.1.4 versions. The vulnerability exists in the Media Manager component, which comes by default in Joomla, allowing arbitrary file uploads, and results in arbitrary code execution. The module has been...

HP SiteScope Remote Code Execution

This module exploits a code execution flaw in HP SiteScope. The vulnerability exists in the opcactivate.vbs script, which is reachable from the APIBSMIntegrationImpl AXIS service, and uses WScript.Shell.run to execute cmd.exe with user provided data. Note that the opcactivate.vbs component is...

Gather eCryptfs Metadata

This module will collect the contents of all users' .ecrypts directories on the targeted machine. Collected "wrapped-passphrase" files can be cracked with John the Ripper JtR to recover "mount passphrases". This module requires Metasploit: https://metasploit.com/download Current source:...

HP LoadRunner magentproc.exe Overflow

This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use...

PineApp Mail-SeCure ldapsyncnow.php Arbitrary Command Execution

This module exploits a command injection vulnerability on PineApp Mail-SeCure 3.70. The vulnerability exists on the ldapsyncnow.php component, due to the insecure usage of the shellexec php function. This module has been tested successfully on PineApp Mail-SeCure 3.70. Module Options msf use...

PineApp Mail-SeCure test_li_connection.php Arbitrary Command Execution

This module exploits a command injection vulnerability on PineApp Mail-SeCure 3.70. The vulnerability exists on the testliconnection.php component, due to the insecure usage of the system php function. This module has been tested successfully on PineApp Mail-SeCure 3.70. Module Options msf use...

Cogent DataHub HTTP Server Buffer Overflow

This module exploits a stack based buffer overflow on Cogent DataHub 7.3.0. The vulnerability exists in the HTTP server. While handling HTTP headers, a strncpy function is used in a dangerous way. This module has been tested successfully on Cogent DataHub 7.3.0 Demo on Windows XP SP3. Module...

PineApp Mail-SeCure livelog.html Arbitrary Command Execution

This module exploits a command injection vulnerability on PineApp Mail-SeCure 3.70. The vulnerability exists on the livelog.html component, due to the insecure usage of the shellexec php function. This module has been tested successfully on PineApp Mail-SeCure 3.70. Module Options msf use...

Chasys Draw IES Buffer Overflow

This module exploits a buffer overflow vulnerability found in Chasys Draw IES version 4.10.01. The vulnerability exists in the module fltBMP.dll, while parsing BMP files, where the ReadFile function is used to store user provided data on the stack in an insecure way. It results in arbitrary code...

HP LoadRunner lrFileIOService ActiveX WriteFileString Remote Code Execution

This module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileString method, which allow the user to write arbitrary files. It's abused to drop a payload embedded in a dll, which is later loaded through the Ini...

HP LoadRunner lrFileIOService ActiveX Remote Code Execution

This module exploits a vulnerability on the lrFileIOService ActiveX, as installed with HP LoadRunner 11.50. The vulnerability exists in the WriteFileBinary method where user provided data is used as a memory pointer. This module has been tested successfully on IE6-IE9 on Windows XP, Vista and 7,...

SAP Host Agent Information Disclosure

This module attempts to retrieve Computer and OS info from Host Agent through the SAP HostControl service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'SAP Host Agen...

Script Web Delivery

This module quickly fires up a web server that serves a payload. The module will provide a command to be run on the target machine based on the selected target. The provided command will download and execute a payload using either a specified scripting language interpreter or "squiblydoo" via...

Oracle Endeca Server Remote Command Execution

This module exploits a command injection vulnerability on the Oracle Endeca Server 7.4.0. The vulnerability exists on the createDataStore method from the controlSoapBinding web service. The vulnerable method only exists on the 7.4.0 branch and isn't available on the 7.5.5.1 branch. In addition, t...

Windows Gather Enumerate Active Domain Users

This module will enumerate computers included in the primary Domain and attempt to list all locations the targeted user has sessions on. If the HOST option is specified the module will target only that host. If the HOST is specified and USER is set to nil, all users logged into that host will be...

SPIP connect Parameter PHP Injection

This module exploits a PHP code injection in SPIP. The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 2.0, 2.1 and 3 are concerned. Vulnerable versions are 'SPIP connect Parameter PHP Injection',...

Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager with Support for Custom Proxy

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTP using SSL with custom proxy support This module requires Metasploit: https://metasploit.com/download Current source:...

Linksys Devices pingstr Remote Command Injection

The Linksys WRT100 and WRT110 consumer routers are vulnerable to a command injection exploit in the ping field of the web interface. Module Options msf use exploit/linux/http/linksys/wrt110cmdexec msf undefinedwrt110cmdexec show actions ...actions... msf undefinedwrt110cmdexec set ACTION msf...

Cisco PVC2300 POE Video Camera configuration download

This module exploits an information disclosure vulnerability in Cisco PVC2300 cameras in order to download the configuration file containing the admin credentials for the web interface. The module first performs a basic check to see if the target is likely Cisco PVC2300. If so, the module attempt...

NETGEAR ReadyNAS Perl Code Evaluation

This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The vulnerability exists on the web front end, specifically in the nphandler.pl component, due to an insecure usage of the eval perl function. This module has been tested successfully on a NETGEAR ReadyNAS 4.2.23...

Ultra Mini HTTPD Stack Buffer Overflow

This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21, allowing remote attackers to execute arbitrary code via a long resource name in an HTTP request. This exploit has to deal with the fact that the application's request handler thread is terminated after 60 seconds by a...

Apache Rave User Information Disclosure

This module exploits an information disclosure in Apache Rave 0.20 and prior. The vulnerability exists in the RPC API, which allows any authenticated user to disclose information about all the users, including their password hashes. In order to authenticate, the user can provide his own...

MS13-055 Microsoft Internet Explorer CAnchorElement Use-After-Free

In IE8 standards mode, it's possible to cause a use-after-free condition by first creating an illogical table tree, where a CPhraseElement comes after CTableRow, with the final node being a sub table element. When the CPhraseElement's outer content is reset by using either outerText or outerHTML...

Corel PDF Fusion Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version 1.11 of Corel PDF Fusion. The vulnerability exists while handling a XPS file with long entry names. In order for the payload to be executed, an attacker must convince the target user to open a specially crafted XPS file...