Java Applet JMX Remote Code Execution

This module abuses the JMX classes from a Java Applet to run arbitrary Java code outside of the sandbox as exploited in the wild in January of 2013. The vulnerability affects Java version 7u10 and earlier. Module Options msf use exploit/multi/browser/java/jre17jmxbean msf undefinedjre17jmxbean sh...

Java Applet Driver Manager Privileged toString() Remote Code Execution

This module abuses the java.sql.DriverManager class where the toString method is called over user supplied classes from a doPrivileged block. The vulnerability affects Java version 7u17 and earlier. This exploit bypasses click-to-play on Internet Explorer and throws a specially crafted JNLP file...

Java Applet Reflection Type Confusion Remote Code Execution

This module abuses Java Reflection to generate a Type Confusion, due to a weak access control when setting final fields on static classes, and run code outside of the Java Sandbox. The vulnerability affects Java version 7u17 and earlier. This exploit bypasses click-to-play throw a specially craft...

Ruby on Rails XML Processor YAML Deserialization Scanner

This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the XML request processor. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ruby ...

BigAnt Server DUPF Command Arbitrary File Upload

This exploits an arbitrary file upload vulnerability in BigAnt Server 2.97 SP7. A lack of authentication allows to make unauthenticated file uploads through a DUPF command. Additionally the filename option in the same command can be used to launch a directory traversal attack and achieve arbitrar...

BigAnt Server 2 SCH And DUPF Buffer Overflow

This exploits a stack buffer overflow in BigAnt Server 2.97 SP7. The vulnerability is due to the dangerous usage of strcpy while handling errors. This module uses a combination of SCH and DUPF request to trigger the vulnerability, and has been tested successfully against version 2.97 SP7 over...

Firefox XMLSerializer Use After Free

This module exploits a vulnerability found on Firefox 17.0 use exploit/windows/browser/mozilla/firefoxxmlserializer msf undefinedfirefoxxmlserializer show actions ...actions... msf undefinedfirefoxxmlserializer set ACTION msf undefinedfirefoxxmlserializer show options ...show and set options... m...

Firefox 17.0.1 Flash Privileged Code Injection

This exploit gains remote code execution on Firefox 17 and 17.0.1, provided the user has installed Flash. No memory corruption is used. First, a Flash object is cloned into the anonymous content of the SVG "use" element in the CVE-2013-0758. From there, the Flash object can navigate a child frame...

Movable Type 4.2x, 4.3x Web Upgrade Remote Code Execution

This module can be used to execute a payload on MoveableType MT that exposes a CGI script, mt-upgrade.cgi usually at /mt/mt-upgrade.cgi, that is used during installation and updating of the platform. The vulnerability arises due to the following properties: 1. This script may be invoked remotely...

Foxit Reader Plugin URL Processing Buffer Overflow

This module exploits a vulnerability in the Foxit Reader Plugin, it exists in the npFoxitReaderPlugin.dll module. When loading PDF files from remote hosts, overly long query strings within URLs can cause a stack-based buffer overflow, which can be exploited to execute arbitrary code. This exploit...

Ruby on Rails XML Processor YAML Deserialization Code Execution

This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application...

Wordpress Pingback Locator

This module will scan for wordpress sites with the Pingback API enabled. By interfacing with the API an attacker can cause the wordpress site to port scan an external target and return results. Refer to the wordpresspingbackportscanner module. This issue was fixed in wordpress 3.5.1 This module...

Distributed Ruby Remote Code Execution

This module exploits remote code execution vulnerabilities in dRuby...

Windows Gather Google Chrome User Data Enumeration

This module will collect user data from Google Chrome and attempt to decrypt sensitive information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Google Chrome User Data...

Windows Gather Local and Domain Controller Account Password Hashes

This will dump local accounts from the SAM Database. If the target host is a Domain Controller, it will dump the Domain Account Database using the proper technique depending on privilege level, OS and role of the host. This module requires Metasploit: https://metasploit.com/download Current sourc...

WordPress Plugin Google Document Embedder Arbitrary File Disclosure

This module exploits an arbitrary file disclosure flaw in the WordPress blogging software plugin known as Google Document Embedder. The vulnerability allows for database credential disclosure via the /libs/pdf.php script. The Google Document Embedder plug-in versions 2.4.6 and below are vulnerabl...

Simple Web Server 2.3-RC1 Directory Traversal

This module exploits a directory traversal vulnerability found in Simple Web Server 2.3-RC1. Module Options msf use auxiliary/scanner/http/simple/webservertraversal msf undefinedwebservertraversal show actions ...actions... msf undefinedwebservertraversal set ACTION msf undefinedwebservertraversa...

MSSQL Password Hashdump

This module extracts the usernames and encrypted password hashes from a MSSQL server and stores them for later cracking. This module also saves information about the server version and table names, which can be used to seed the wordlist. This module requires Metasploit:...

John the Ripper MS SQL Password Cracker (Fast Mode)

This module uses John the Ripper to identify weak passwords that have been acquired from the mssqlhashdump module. Passwords that have been successfully cracked are then saved as proper credentials...

John the Ripper Linux Password Cracker

This module uses John the Ripper to identify weak passwords that have been acquired from unshadowed passwd files from Unix systems. The module will only crack MD5, BSDi and DES implementations by default. Set Crypt to true to also try to crack Blowfish and SHA256/512. Warning: This is much slower...

FTP Authentication Scanner

This module will test FTP logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access. This module requires Metasploit: https://metasploit.com/download...

POP3 Login Utility

This module attempts to authenticate to an POP3 service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/pop3' require 'metasploit/framework/credentialcollection' class...

Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

Windows Service for User (S4U) Scheduled Task Persistence - Schedule Trigger

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

Windows Service for User (S4U) Scheduled Task Persistence - Logon Trigger

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

Windows Service for User (S4U) Scheduled Task Persistence - Event Trigger

Creates a scheduled task that will run using service-for-user S4U. This allows the scheduled task to run even as an unprivileged user that is not logged into the device. This will result in lower security context, allowing access to local resources only. The module requires 'Logon as a batch job'...

Windows Meterpreter (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Windows Meterpreter (skape/jt Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject the meterpreter server DLL staged. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 415 include Msf::Payload::Stager include...

Windows Upload/Execute, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Uploads an executable and runs it staged. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 415 include Msf::Payload::Stager include...

VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject a VNC Dll via a reflective loader staged. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 415 include Msf::Payload::Stager inclu...

Windows Command Shell, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Spawn a piped command shell staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 413 include Msf::Payload::Stager include...

Windows Upload/Execute, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Uploads an executable and runs it staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 413 include Msf::Payload::Stager include...

Reflective DLL Injection, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject a DLL via a reflective loader. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 415 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

VNC Server (Reflective Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Inject a VNC Dll via a reflective loader staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 413 include Msf::Payload::Stager...

Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Inject the meterpreter server DLL staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 413 include Msf::Payload::Stager include...

Windows Inject DLL, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Inject a custom DLL into the exploited process. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 413 include Msf::Payload::Stager...

Windows Inject DLL, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject a custom DLL into the exploited process. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 415 include Msf::Payload::Stager includ...

Reflective DLL Injection, Reverse TCP Stager (RC4 Stage Encryption, Metasm)

Inject a DLL via a reflective loader. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 413 include Msf::Payload::Stager include...

Windows Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Spawn a piped command shell staged. Listen for a connection -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 415 include Msf::Payload::Stager include...

eXtplorer v2.1 Arbitrary File Upload Vulnerability

This module exploits an authentication bypass vulnerability in eXtplorer versions 2.1.0 to 2.1.2 and 2.1.0RC5 when run as a standalone application. This application has an upload feature that allows an authenticated user with administrator roles to upload arbitrary files to any writable directory...

Wordpress Reflex Gallery Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution. Module Options msf use exploit/unix/webapp/wp/reflexgalleryfileupload msf undefinedreflexgalleryfileupload show actions...

MoinMoin twikidraw Action Traversal File Upload

This module exploits a vulnerability in MoinMoin 1.9.5. The vulnerability exists on the manage of the twikidraw actions, where a traversal path can be used in order to upload arbitrary files. Exploitation is achieved on Apached/modwsgi configurations by overwriting moin.wsgi, which allows to...

MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability

This module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CButton object is freed, but a reference is kept and used again during a page reload, an invalid memory that's controllable is used, and allows arbitrary code execution under the...

Windows Gather Spark IM Password Extraction

This module will enumerate passwords stored by the Spark IM client. The encryption key is publicly known. This module will not only extract encrypted password but will also decrypt password using public key. This module requires Metasploit: https://metasploit.com/download Current source:...

Nvidia (nvsvc) Display Driver Service Local Privilege Escalation

The named pipe, \pipe\nsvr, has a NULL DACL allowing any authenticated user to interact with the service. It contains a stacked based buffer overflow as a result of a memmove operation. Note the slight spelling differences: the executable is 'nvvsvc.exe', the service name is 'nvsvc', and the name...

Android Browser and WebView addJavascriptInterface Code Execution

This module exploits a privilege escalation issue in Android use exploit/android/browser/webview/addjavascriptinterface msf undefinedaddjavascriptinterface show actions ...actions... msf undefinedaddjavascriptinterface set ACTION msf undefinedaddjavascriptinterface show options ...show and set...

Outlook Web App (OWA) / Client Access Server (CAS) IIS HTTP Internal IP Disclosure

This module tests vulnerable IIS HTTP header file paths on Microsoft Exchange OWA 2003 and CAS 2007, 2010, and 2013 servers. Module Options msf use auxiliary/scanner/http/owa/iisinternalip msf undefinediisinternalip show actions ...actions... msf undefinediisinternalip set ACTION msf...

TWiki MAKETEXT Remote Command Execution

This module exploits a vulnerability in the MAKETEXT Twiki variable. By using a specially crafted MAKETEXT, a malicious user can execute shell commands since user input is passed to the Perl "eval" command without first being sanitized. The problem is caused by an underlying security issue in the...

RealPlayer RealMedia File Handling Buffer Overflow

This module exploits a stack based buffer overflow on RealPlayer use exploit/windows/fileformat/real/playerurlpropertybof msf undefinedplayerurlpropertybof show actions ...actions... msf undefinedplayerurlpropertybof set ACTION msf undefinedplayerurlpropertybof show options ...show and set...