HP System Management Homepage JustGetSNMPQueue Command Injection

This module exploits a vulnerability found in HP System Management Homepage. By supplying a specially crafted HTTP request, it is possible to control the 'tempfilename' variable in function JustGetSNMPQueue found in ginkgosnmp.inc, which will be used in a exec function. Module Options msf use...

RFCode Reader Web Interface Login / Bruteforce Utility

This module simply attempts to login to a RFCode Reader web interface. Please note that by default there is no authentication. In such a case, password brute force will not be performed. If there is authentication configured, the module will attempt to find valid login credentials and capture...

SevOne Network Performance Management Application Brute Force Login Utility

This module scans for SevOne Network Performance Management System Application, finds its version, and performs login brute force to identify valid credentials. Module Options msf use auxiliary/scanner/http/sevone/enum msf undefinedenum show actions ...actions... msf undefinedenum set ACTION msf...

ZPanel 10.0.0.2 htpasswd Module Username Command Execution

This module exploits a vulnerability found in ZPanel's htpasswd module. When creating .htaccess using the htpasswd module, the username field can be used to inject system commands, which is passed on to a system function for executing the system's htpasswd command. Please note: In order to use th...

ZPanel zsudo Local Privilege Escalation Exploit

This module abuses the zsudo binary, installed with zpanel, to escalate privileges. In order to work, a session with access to zsudo on the sudoers configuration is needed. This module is useful for post exploitation of ZPanel vulnerabilities, where typically web server privileges are acquired, a...

Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment

This module exploits a mass assignment vulnerability in the 'create' action of 'users' controller of Foreman and Red Hat OpenStack/Satellite Foreman 1.2.0-RC1 and earlier by creating an arbitrary administrator account. For this exploit to work, your account must have 'createusers' permission e.g....

Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection

This module exploits a code injection vulnerability in the 'create' action of 'bookmarks' controller of Foreman and Red Hat OpenStack/Satellite Foreman 1.2.0-RC1 and earlier. Module Options msf use exploit/linux/http/foreman/openstacksatellitecodeexec msf undefinedopenstacksatellitecodeexec show...

Netgear DGN1000 Setup.cgi Unauthenticated RCE

This module exploits an unauthenticated OS command execution vulneralbility in the setup.cgi file in Netgear DGN1000 firmware versions up to 1.1.00.48, and DGN2000v1 models. Module Options msf use exploit/linux/http/netgear/dgn1000setupunauthexec msf undefineddgn1000setupunauthexec show actions...

Novell Zenworks Mobile Device Management Admin Credentials

This module attempts to pull the administrator credentials from a vulnerable Novell Zenworks MDM server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Novell Zenworks Mobile Device Management...

HP Data Protector Cell Request Service Buffer Overflow

This module exploits a stack-based buffer overflow in the Hewlett-Packard Data Protector product. The vulnerability, due to the insecure usage of swprintf, exists at the Cell Request Service crs.exe when parsing packets with opcode 211. This module has been tested successfully on HP Data Protecto...

Unix Command Shell, Bind TCP (via AWK)

Listen for a connection and spawn a command shell via GNU AWK This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 140 include Msf::Payload::Single include...

Unix Command Shell, Reverse TCP (via AWK)

Creates an interactive shell via GNU AWK This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 154 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

Intrasrv 1.0 Buffer Overflow

This module exploits a boundary condition error in Intrasrv Simple Web Server 1.0. The web interface does not validate the boundaries of an HTTP request string prior to copying the data to an insufficiently sized buffer. Successful exploitation leads to arbitrary remote code execution in the...

Synactis PDF In-The-Box ConnectToSynactic Stack Buffer Overflow

This module exploits a vulnerability found in Synactis' PDF In-The-Box ActiveX component, specifically PDFIN1.ocx. When a long string of data is given to the ConnectToSynactis function, which is meant to be used for the ldCmdLine argument of a WinExec call, a strcpy routine can end up overwriting...

Monkey HTTPD Header Parsing Denial of Service (DoS)

This module causes improper header parsing that leads to a segmentation fault due to a specially crafted HTTP request. Affects version use auxiliary/dos/http/monkey/headers msf undefinedheaders show actions ...actions... msf undefinedheaders set ACTION msf undefinedheaders show options ...show an...

Siemens Solid Edge ST4 SEListCtrlX ActiveX Remote Code Execution

This module exploits the SEListCtrlX ActiveX installed with the Siemens Solid Edge product. The vulnerability exists on several APIs provided by the control, where user supplied input is handled as a memory pointer without proper validation, allowing an attacker to read and corrupt memory from th...

Apache Struts includeParams Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/includeparams msf undefinedincludeparams show actions ...actions... msf undefinedincludeparams set ACTION msf undefinedincludeparams show options ...show and set options... msf...

ERS Viewer 2013 ERS File Handling Buffer Overflow

This module exploits a buffer overflow vulnerability found in ERS Viewer 2013. The vulnerability exists in the module ermapperu.dll, where the function rfreporterror handles user provided data in an insecure way. It results in arbitrary code execution under the context of the user viewing a...

Java JMX Server Insecure Configuration Java Code Execution

This module takes advantage a Java JMX interface insecure configuration, which would allow loading classes from any remote HTTP URL. JMX interfaces with authentication disabled com.sun.management.jmxremote.authenticate=false should be vulnerable, while interfaces with authentication enabled will ...

Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow

This module exploits a stack buffer overflow in the dbnetserver process, which is spawned by the Lianja SQL server. The issue is fixed in Lianja SQL 1.0.0RC5.2. Module Options msf use exploit/windows/misc/lianja/dbnet msf undefineddbnet show actions ...actions... msf undefineddbnet set ACTION msf...

Java JMX Server Insecure Endpoint Code Execution Scanner

Detect Java JMX endpoints Module Options msf use auxiliary/scanner/misc/java/jmxserver msf undefinedjmxserver show actions ...actions... msf undefinedjmxserver set ACTION msf undefinedjmxserver show options ...show and set options... msf undefinedjmxserver run This module requires Metasploit:...

Apple Quicktime 7 Invalid Atom Length Buffer Overflow

This module exploits a vulnerability found in Apple QuickTime. The flaw is triggered when QuickTime fails to properly handle the data length for certain atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer overflow by loading a specially crafted .mov file, and allows...

Apple Quicktime 7 Invalid Atom Length Buffer Overflow

This module exploits a vulnerability found in Apple Quicktime. The flaw is triggered when Quicktime fails to properly handle the data length for certain atoms such as 'rdrf' or 'dref' in the Alis record, which may result a buffer overflow by loading a specially crafted .mov file, and allows...

Novell Client 2 SP3 nicm.sys Local Privilege Escalation

This module exploits a flaw in the nicm.sys driver to execute arbitrary code in kernel space. The vulnerability occurs while handling ioctl requests with code 0x143B6B, where a user provided pointer is used as function pointer. The module has been tested successfully on Windows 7 SP1 with Novell...

Kimai v0.9.2 'db_restore.php' SQL Injection

This module exploits a SQL injection vulnerability in Kimai version 0.9.2.x. The 'dbrestore.php' file allows unauthenticated users to execute arbitrary SQL queries. This module writes a PHP payload to disk if the following conditions are met: The PHP configuration must have 'displayerrors' enable...

Linux Meterpreter, Reverse TCP Stager

Inject the mettle server payload staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- Linux reverse TCP stager. module MetasploitModule CachedSize = 260 include...

Linux dup2 Command Shell, Reverse TCP Stager

dup2 socket in r12, then execve. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- Linux reverse TCP stager. module MetasploitModule CachedSize = 260 include...

Linux Meterpreter, Bind TCP Stager

Inject the mettle server payload staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Linux bind TCP stager. module MetasploitModule CachedSize = 232 include...

Linux dup2 Command Shell, Bind TCP Stager

dup2 socket in r12, then execve. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Linux bind TCP stager. module MetasploitModule CachedSize = 232 include...

SAP CTC Service Verb Tampering User Management

This module exploits an authentication bypass vulnerability in SAP NetWeaver CTC service. The service is vulnerable to verb tampering allowing for unauthorised OS user management. Information about resolution should be available at SAP notes 1589525 and 1624450 authentication required. This modul...

SAP SMB Relay Abuse

This module exploits provides several SMB Relay abuse through different SAP services and functions. The attack is done through specially crafted requests including a UNC Path which will be accessing by the SAP system while trying to process the request. In order to get the hashes the...

Mutiny 5 Arbitrary File Read and Delete

This module exploits the EditDocument servlet from the frontend on the Mutiny 5 appliance. The EditDocument servlet provides file operations, such as copy and delete, which are affected by a directory traversal vulnerability. Because of this, any authenticated frontend user can read and delete...

Mutiny 5 Arbitrary File Upload

This module exploits a code execution flaw in the Mutiny 5 appliance. The EditDocument servlet provides a file upload function to authenticated users. A directory traversal vulnerability in the same functionality allows for arbitrary file upload, which results in arbitrary code execution with roo...

VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload

This module exploits a code execution flaw in VMware vCenter Chargeback Manager, where the ImageUploadServlet servlet allows unauthenticated file upload. The files are uploaded to the /cbmui/images/ web path, where JSP code execution is allowed. The module has been tested successfully on VMware...

Windows EPATHOBJ::pprFlattenRec Local Privilege Escalation

This module exploits a vulnerability on EPATHOBJ::pprFlattenRec due to the usage of uninitialized data which allows to corrupt memory. At the moment, the module has been tested successfully on Windows XP SP3, Windows 2003 SP1, and Windows 7 SP1. Module Options msf use...

Firefox toString console.time Privileged Javascript Injection

This exploit gains remote code execution on Firefox 15-22 by abusing two separate Javascript-related vulnerabilities to ultimately inject malicious Javascript code into a context running with chrome:// privileges. Module Options msf use exploit/multi/browser/firefox/tostringconsoleinjection msf...

AdobeCollabSync Buffer Overflow Adobe Reader X Sandbox Bypass

This module exploits a vulnerability on Adobe Reader X Sandbox. The vulnerability is due to a sandbox rule allowing a Low Integrity AcroRd32.exe process to write register values which can be used to trigger a buffer overflow on the AdobeCollabSync component, allowing to achieve Medium Integrity...

Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse HTTP Stager (wininet)

Inject a VNC Dll via a reflective loader Windows x64 staged. Tunnel communication over HTTP Windows x64 wininet This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 644 include...

Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse HTTP Stager (wininet)

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTP Windows x64 wininet This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Windows Manage Remote Point-to-Point Tunneling Protocol

This module initiates a PPTP connection to a remote machine VPN server. Once the tunnel is created we can use it to force the victim traffic to go through the server getting a man in the middle attack. Be sure to allow forwarding and masquerading on the VPN server mitm. This module requires...

FTP JCL Execution

Submit JCL to z/OS via FTP and SITE FILE=JES. This exploit requires valid credentials on the target system. Module Options msf use exploit/mainframe/ftp/ftp/jclcreds msf undefinedjclcreds show actions ...actions... msf undefinedjclcreds set ACTION msf undefinedjclcreds show options ...show and se...

CouchDB Enum Utility

This module enumerates databases on CouchDB using the REST API without authentication by default. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CouchDB Enum Utility', 'Description' = %q This...

CouchDB Login Utility

This module tests CouchDB logins on a range of machines and report successful logins. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CouchDB Login Utility', 'Description' = % This module tests...

Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow

This module exploits a stack buffer overflow in versions 1.3.9 to 1.4.0 of nginx. The exploit first triggers an integer overflow in the ngxhttpparsechunked by supplying an overly long hex value as chunked block size. This value is later used when determining the number of bytes to read into a sta...

ColdFusion 'password.properties' Hash Extraction

This module uses a directory traversal vulnerability to extract information such as password, rdspassword, and "encrypted" properties. This module has been tested successfully on ColdFusion 9 and ColdFusion 10 auto-detect. Module Options msf use auxiliary/gather/coldfusion/pwdprops msf...

SAP SOAP RFC EPS_GET_DIRECTORY_LISTING Directories Information Disclosure

This module abuses the SAP NetWeaver EPSGETDIRECTORYLISTING function, on the SAP SOAP RFC Service, to check for remote directory existence and get the number of entries on it. The module can also be used to capture SMB hashes by using a fake SMB share as DIR. This module requires Metasploit:...

D-Link DSL 320B Password Extractor

This module exploits an authentication bypass vulnerability in D-Link DSL 320B 'D-Link DSL 320B Password Extractor', 'Description' = %q This module exploits an authentication bypass vulnerability in D-Link DSL 320B 'EDB', '25252' , 'OSVDB', '93013' , 'URL', 'http://www.s3cur1ty.de/m1adv2013-018' ...

SAP SOAP EPS_DELETE_FILE File Deletion

This module abuses the SAP NetWeaver EPSDELETEFILE function, on the SAP SOAP RFC Service, to delete arbitrary files on the remote file system. The module can also be used to capture SMB hashes by using a fake SMB share as DIRNAME. This module requires Metasploit: https://metasploit.com/download...

MS13-038 Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability

This module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the Document and used again during rendering, an invalid memory that's controllable is used, and allows arbitrary code...

Exim and Dovecot Insecure Configuration Command Injection

This module exploits a command injection vulnerability against Dovecot with Exim using the "useshell" option. It uses the sender's address to inject arbitrary commands, since this is one of the user-controlled variables. It has been successfully tested on Debian Squeeze using the default Exim4 wi...