D-Link DIR-300B / DIR-600B / DIR-815 / DIR-645 HTTP Login Utility

This module attempts to authenticate to different D-Link HTTP management services. It has been tested successfully on D-Link DIR-300 Hardware revision B, D-Link DIR-600 Hardware revision B, D-Link DIR-815 Hardware revision A and DIR-645 Hardware revision A devices. It is possible that this module...

PostgreSQL Database Name Command Line Flag Injection

This module can identify PostgreSQL 9.0, 9.1, and 9.2 servers that are vulnerable to command-line flag injection through CVE-2013-1899. This can lead to denial of service, privilege escalation, or even arbitrary code execution. This module requires Metasploit: https://metasploit.com/download...

Sophos Web Protection Appliance patience.cgi Directory Traversal

This module abuses a directory traversal in Sophos Web Protection Appliance, specifically on the /cgi-bin/patience.cgi component. This module has been tested successfully on the Sophos Web Virtual Appliance v3.7.0. Module Options msf use auxiliary/admin/http/sophos/wpatraversal msf...

HP Intelligent Management IctDownloadServlet Directory Traversal

This module exploits a lack of authentication and a directory traversal in HP Intelligent Management, specifically in the IctDownloadServlet, in order to retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully on HP Intelligent Management Center 5.1 E0202 over...

HP Intelligent Management ReportImgServlt Directory Traversal

This module exploits a lack of authentication and a directory traversal in HP Intelligent Management, specifically in the ReportImgServlt, in order to retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully on HP Intelligent Management Center 5.1 E0202 over Windo...

HP Intelligent Management FaultDownloadServlet Directory Traversal

This module exploits a lack of authentication and a directory traversal in HP Intelligent Management, specifically in the FaultDownloadServlet, in order to retrieve arbitrary files with SYSTEM privileges. This module has been tested successfully on HP Intelligent Management Center 5.1 E0202 over...

Windows Gather Deleted Files Enumeration and Recovering

This module lists and attempts to recover deleted files from NTFS file systems. Use the FILES option to guide recovery. Leave this option empty to enumerate deleted files in the DRIVE. Set FILES to an extension e.g., "pdf" to recover deleted files with that extension, or set FILES to a comma...

HP System Management Homepage Local Privilege Escalation

Versions of HP System Management Homepage use exploit/linux/local/hp/smhstart msf undefinedsmhstart show actions ...actions... msf undefinedsmhstart set ACTION msf undefinedsmhstart show options ...show and set options... msf undefinedsmhstart run This module requires Metasploit:...

Windows Gather Microsoft Office Word UNC Path Injector

This module modifies a remote .docx file that will, upon opening, submit stored netNTLM credentials to a remote host. Verified to work with Microsoft Word 2003, 2007, 2010, and 2013. In order to get the hashes the auxiliary/server/capture/smb module can be used. This module requires Metasploit:...

D-Link DIR-615H HTTP Login Utility

This module attempts to authenticate to different D-Link HTTP management services. It has been tested successfully on D-Link DIR-615 Hardware revision H devices. It is possible that this module also works with other models. This module requires Metasploit: https://metasploit.com/download Current...

MiniUPnPd 1.4 Denial of Service (DoS) Exploit

This module allows remote attackers to cause a denial of service DoS in MiniUPnP 1.0 server via a specifically crafted UDP request. Module Options msf use auxiliary/dos/upnp/miniupnpd/dos msf undefineddos show actions ...actions... msf undefineddos set ACTION msf undefineddos show options ...show...

MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution

This module exploits the MiniUPnP 1.0 SOAP stack buffer overflow vulnerability present in the SOAPAction HTTP header handling. Module Options msf use exploit/linux/upnp/miniupnpd/soapbof msf undefinedsoapbof show actions ...actions... msf undefinedsoapbof set ACTION msf undefinedsoapbof show...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload

vTiger CRM allows a user to bypass authentication when requesting SOAP services. In addition, arbitrary file upload is possible through the AddEmailAttachment SOAP service. By combining both vulnerabilities an attacker can upload and execute PHP code. This module has been tested successfully on...

SAP SOAP RFC SXPG_CALL_SYSTEM Remote Command Execution

This module abuses the SAP NetWeaver SXPGCALLSYSTEM function, on the SAP SOAP RFC Service, to execute remote commands. This module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64-bit and Linux 64-bit...

Linksys E1500 Directory Traversal Vulnerability

This module exploits a directory traversal vulnerability which is present in different Linksys home routers, like the E1500. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linksys E1500...

D-Link DIR-300A / DIR-320 / DIR-615D HTTP Login Utility

This module attempts to authenticate to different D-Link HTTP management services. It has been tested on D-Link DIR-300 Hardware revision A, D-Link DIR-615 Hardware revision D and D-Link DIR-320 devices. It is possible that this module also works with other models. This module requires Metasploit...

vBulletin index.php/ajax/api/reputation/vote nodeid Parameter SQL Injection

This module exploits a SQL injection vulnerability found in vBulletin 5 that has been used in the wild since March 2013. This module uses the sqli to extract the web application's usernames and hashes. With the retrieved information tries to log into the admin control panel in order to deploy the...

D-Link DIR 645 Password Extractor

This module exploits an authentication bypass vulnerability in DIR 645 'D-Link DIR 645 Password Extractor', 'Description' = %q This module exploits an authentication bypass vulnerability in DIR 645 'OSVDB', '90733' , 'BID', '58231' , 'PACKETSTORM', '120591' , 'Author' = 'Roberto Paleari ',...

Ra1NX PHP Bot PubCall Authentication Bypass Remote Code Execution

This module allows remote command execution on the PHP IRC bot Ra1NX by using the public call feature in private message to covertly bypass the authentication system. Module Options msf use exploit/multi/misc/ra1nx/pubcallexec msf undefinedpubcallexec show actions ...actions... msf...

MongoDB nativeHelper.apply Remote Code Execution

This module exploits the nativeHelper feature from spiderMonkey which allows remote code execution by calling it with specially crafted arguments. This module has been tested successfully on MongoDB 2.2.3 on Ubuntu 10.04 and Debian Squeeze. Module Options msf use...

vBulletin Password Collector via nodeid SQL Injection

This module exploits a SQL injection vulnerability found in vBulletin 5 that has been used in the wild since March 2013. This module can be used to extract the web application's usernames and hashes, which could be used to authenticate into the vBulletin admin control panel. Module Options msf us...

Netgear SPH200D Directory Traversal Vulnerability

This module exploits a directory traversal vulnerability which is present in Netgear SPH200D Skype telephone. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netgear SPH200D Directory Traversal...

TP-Link Wireless Lite N Access Point Directory Traversal Vulnerability

This module tests whether a directory traversal vulnerability is present in versions of TP-Link Access Point 3.12.16 Build 120228 Rel.37317n. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

STUNSHELL Web Shell Remote Code Execution

This module exploits unauthenticated versions of the "STUNSHELL" web shell. This module works when safe mode is disabled on the web server. This shell is widely used in automated RFI payloads. Module Options msf use exploit/multi/http/stunshell/exec msf undefinedexec show actions ...actions... ms...

STUNSHELL Web Shell Remote PHP Code Execution

This module exploits unauthenticated versions of the "STUNSHELL" web shell. This module works when safe mode is enabled on the web server. This shell is widely used in automated RFI payloads. Module Options msf use exploit/multi/http/stunshell/eval msf undefinedeval show actions ...actions... msf...

v0pCr3w Web Shell Remote Code Execution

This module exploits a lack of authentication in the shell developed by v0pCr3w and is widely reused in automated RFI payloads. This module takes advantage of the shell's various methods to execute commands. Module Options msf use exploit/multi/http/v0pcr3w/exec msf undefinedexec show actions...

Novell ZENworks Configuration Management Remote Execution

This module exploits a code execution flaw in Novell ZENworks Configuration Management 10 SP3 and 11 SP2. The vulnerability exists in the ZENworks Control Center application, allowing an unauthenticated attacker to upload a malicious file outside of the TEMP directory and then make a second reque...

Docker Image Persistence

This module maintains persistence on a host by creating a docker image which runs our payload, and has access to the host's file system /host in the container. Whenever the container restarts, the payload will run, or when the payload dies the executable will run again after a delay. This will...

Sysax Multi-Server 6.10 SSHD Key Exchange Denial of Service

This module sends a specially-crafted SSH Key Exchange causing the service to crash. Module Options msf use auxiliary/dos/windows/ssh/sysax/sshdkexchange msf undefinedsshdkexchange show actions ...actions... msf undefinedsshdkexchange set ACTION msf undefinedsshdkexchange show options ...show and...

Linux Manage Download and Execute

This module downloads and runs a file with bash. It first tries to uses curl as its HTTP client and then wget if it's not found. Bash found in the PATH is used to execute the file. This module requires Metasploit: https://metasploit.com/download Current source:...

Dopewars Denial of Service

The jet command in Dopewars 1.5.12 is vulnerable to a segmentation fault due to a lack of input validation. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Dopewars Denial of Service',...

PsExec NTDS.dit And SYSTEM Hive Download Utility

This module authenticates to an Active Directory Domain Controller and creates a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM hive copy can be used in combination with other tools for...

Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability

This module exercises a vulnerability in Novel Zenworks Mobile Management's Mobile Device Management component which can allow unauthenticated remote code execution. Due to a flaw in the MDM.php script's input validation, remote attackers can both upload and execute code via a directory traversal...

MS13-022 Microsoft Silverlight ScriptObject Unsafe Memory Access

This module exploits a vulnerability in Microsoft Silverlight. The vulnerability exists on the Initialize method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code user controlled it's possible to dereference arbitrary memo...

Unix Command Shell, Reverse TCP (via netcat -e)

Creates an interactive shell via netcat This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 34 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinf...

Unix Command Shell, Bind TCP (via netcat -e)

Listen for a connection and spawn a command shell via netcat This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 24 include Msf::Payload::Single include...

Unix Command Shell, Bind TCP (via netcat -e) IPv6

Listen for a connection and spawn a command shell via netcat This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 25 include Msf::Payload::Single include...

GroundWork monarch_scan.cgi OS Command Injection

This module exploits a vulnerability found in GroundWork 6.7.0. This software is used for network, application and cloud monitoring. The vulnerability exists in the monarchscan.cgi where user controlled input is used in the perl qx function. This allows any remote authenticated attacker, regardle...

PsExec via Current User Token

This module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the services. The result is similar to psexec but with the added benefit of using the session's...

HP Intelligent Management Center Arbitrary File Upload

This module exploits a code execution flaw in HP Intelligent Management Center. The vulnerability exists in the mibFileUpload which is accepting unauthenticated file uploads and handling zip contents in an insecure way. Combining both weaknesses a remote attacker can accomplish arbitrary file...

Discover External IP via Ifconfig.me

This module checks for the public source IP address of the current route to the RHOST by querying the public web application at ifconfig.me. It should be noted this module will register activity on ifconfig.me, which is not affiliated with Metasploit. This module requires Metasploit:...

MS13-037 Microsoft Internet Explorer COALineDashStyleArray Integer Overflow

This module exploits an integer overflow vulnerability on Internet Explorer. The vulnerability exists in the handling of the dashstyle.array length for vml shapes on the vgx.dll module. The exploit has been built and tested specifically against Windows 7 SP1 with Internet Explorer 8. It uses eith...

D-Link DIR-645 / DIR-815 diagnostic.php Command Execution

Some D-Link Routers are vulnerable to OS Command injection in the web interface. On DIR-645 versions prior 1.03 authentication isn't needed to exploit it. On version 1.03 authentication is needed in order to trigger the vulnerability, which has been fixed definitely on version 1.04. Other D-Link...

Java CMM Remote Code Execution

This module abuses the Color Management classes from a Java Applet to run arbitrary Java code outside of the sandbox as exploited in the wild in February and March of 2013. The vulnerability affects Java version 7u15 and earlier and 6u41 and earlier and has been tested successfully on Windows XP...

SAP ICF /sap/public/info Service Sensitive Information Gathering

This module uses the /sap/public/info service within SAP Internet Communication Framework ICF to obtain the operating system version, SAP version, IP address and other information. This module requires Metasploit: https://metasploit.com/download Current source:...

Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Inject a DLL via a reflective loader. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 438 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Inject a VNC Dll via a reflective loader staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 438 include Msf::Payload::Stager...

Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Uploads an executable and runs it staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 438 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption DNS, Metasm)

Inject the meterpreter server DLL staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 438 include Msf::Payload::Stager include...