MS11-081 Microsoft Internet Explorer Option Element Use-After-Free

This module exploits a vulnerability in Microsoft Internet Explorer. A memory corruption may occur when the Option cache isn't updated properly, which allows other JavaScript methods to access a deleted Option element, and results in code execution under the context of the user. Module Options ms...

IKE and AuthIP IPsec Keyring Modules Service (IKEEXT) Missing DLL

This module exploits a missing DLL loaded by the 'IKE and AuthIP Keyring Modules' IKEEXT service which runs as SYSTEM, and starts automatically in default installations of Vista-Win8. It requires an insecure bin path to plant the DLL payload. Module Options msf use...

Project Pier Arbitrary File Upload Vulnerability

This module exploits a vulnerability found in Project Pier. The application's uploading tool does not require any authentication, which allows a malicious user to upload an arbitrary file onto the web server, and then cause remote code execution by simply requesting it. This module is known to wo...

DarkComet Server Remote File Download Exploit

This module exploits an arbitrary file download vulnerability in the DarkComet C&C server versions 3.2 and up. The exploit does not need to know the password chosen for the bot/server communication. Module Options msf use auxiliary/gather/darkcomet/filedownloader msf undefinedfiledownloader show...

PhpTax pfilez Parameter Exec Remote Code Injection

This module exploits a vulnerability found in PhpTax, an income tax report generator. When generating a PDF, the icondrawpng function in drawimage.php does not properly handle the pfilez parameter, which will be used in an exec statement, and then results in arbitrary remote code execution under...

D-Link DIR-605L Captcha Handling Buffer Overflow

This module exploits an anonymous remote code execution vulnerability on D-Link DIR-605L routers. The vulnerability exists while handling user supplied captcha information, and is due to the insecure usage of sprintf on the getAuthCode function. This module has been tested successfully on D-Link...

Turbo FTP Server 1.30.823 PORT Overflow

This module exploits a buffer overflow vulnerability found in the PORT command in Turbo FTP Server 1.30.823 & 1.30.826, which results in remote code execution under the context of SYSTEM. Module Options msf use exploit/windows/ftp/turboftp/port msf undefinedport show actions ...actions... msf...

Multi Gather GnuPG Credentials Collection

This module will collect the contents of all users' .gnupg directories on the targeted machine. Password protected secret keyrings can be cracked with John the Ripper JtR. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

Authentication Capture: PostgreSQL

This module provides a fake PostgreSQL service that is designed to capture clear-text authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture:...

Windows Manage Safe Delete

The goal of the module is to hinder the recovery of deleted files by overwriting its contents. This could be useful when you need to download some file on the victim machine and then delete it without leaving clues about its contents. Note that the script does not wipe the free disk space so...

QNX qconn Command Execution

This module uses the qconn daemon on QNX systems to gain a shell. The QNX qconn daemon does not require authentication and allows remote users to execute arbitrary operating system commands. This module has been tested successfully on QNX Neutrino 6.5.0 x86 and 6.5.0 SP1 x86...

Python Site-Specific Hook Persistence

This module leverages Python's startup mechanism, where some files can be automically processed during the initialization of the Python interpreter. One of those files are startup hooks site-specific, dist-packages. If these files are present in site-specific or dist-packages directories, any lin...

Windows Gather Apache Tomcat Enumeration

This module will collect information from a Windows-based Apache Tomcat. You will get information such as: The installation path, Tomcat version, port, web applications, users, passwords, roles, etc. This module requires Metasploit: https://metasploit.com/download Current source:...

Indusoft WebStudio NTWebServer Remote File Access

This module exploits a directory traversal vulnerability in Indusoft WebStudio. The vulnerability exists in the NTWebServer component and allows to read arbitrary remote files with the privileges of the NTWebServer process. The module has been tested successfully on Indusoft WebStudio 6.1 SP6. Th...

Dell iDRAC Default Login

This module attempts to login to a iDRAC webserver instance using default username and password. Tested against Dell Remote Access Controller 6 - Express version 1.50 and 1.85, Controller 7 - Enterprise 2.63.60.62 Controller 8 - Enterprise 2.83.05 Controller 9 - Enterprise 4.40.00.00 This module...

Splunk Custom App Remote Code Execution

This module exploits a feature of Splunk whereby a custom application can be uploaded through the web based interface. Through the 'script' search command a user can call commands defined in their custom application which includes arbitrary perl or python code. To abuse this behavior, a valid...

phpMyAdmin 3.5.2.2 server_sync.php Backdoor

This module exploits an arbitrary code execution backdoor placed into phpMyAdmin v3.5.2.2 through a compromised SourceForge mirror. Module Options msf use exploit/multi/http/phpmyadmin/3522backdoor msf undefined3522backdoor show actions ...actions... msf undefined3522backdoor set ACTION msf...

HTTP Client Automatic Exploiter

This module has three actions. The first and the default is 'WebServer' which uses a combination of client-side and server-side techniques to fingerprint HTTP clients and then automatically exploit them. Next is 'DefangedDetection' which does only the fingerprinting part. Lastly, 'list' simply...

OS X x64 say Shellcode

Say an arbitrary string outloud using Mac OS X text2speech This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 53 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo,...

OSX Meterpreter, Reverse TCP Stager

Inject the mettle server payload staged. Connect, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 168 include Msf::Payload::Osx::ReverseTcpx64...

OS X dup2 Command Shell, Reverse TCP Stager

dup2 socket in edi, then execve. Connect, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 168 include Msf::Payload::Osx::ReverseTcpx64 include...

OSX Meterpreter, Bind TCP Stager

Inject the mettle server payload staged. Listen, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 185 include Msf::Payload::Stager def initializein...

OS X dup2 Command Shell, Bind TCP Stager

dup2 socket in edi, then execve. Listen, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 185 include Msf::Payload::Stager def initializeinfo =...

OSX Command Shell, Find Tag Inline

Spawn a shell on an established connection proxy/nat safe This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 107 include Msf::Payload::Single include Msf::Payload::Osx include...

Windows Gather Database Instance Enumeration

This module will enumerate a windows system for installed database instances This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Database Instance Enumeration', 'Description' = %q Th...

Printjob Capture Service

This module is designed to listen for PJL or PostScript print jobs. Once a print job is detected it is saved to loot. The captured printjob can then be forwarded on to another printer required for LPR printjobs. Resulting PCL/PS files can be read with GhostScript/GhostPCL. Note, this module does...

OS X x64 Shell Bind TCP

Bind an arbitrary command to an arbitrary port This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 136 include Msf::Payload::Single include Msf::Payload::Osx include...

OS X x64 Shell Reverse TCP

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 128 include Msf::Payload::Single include Msf::Payload::Osx include...

Kloxo Local Privilege Escalation

Version 6.1.12 and earlier of Kloxo contain two setuid root binaries such as lxsuexec and lxrestart, allow local privilege escalation to root from uid 48, Apache by default on CentOS 5.8, the operating system supported by Kloxo. This module has been tested successfully with Kloxo 6.1.12 and 6.1.6...

Auxilium RateMyPet Arbitrary File Upload Vulnerability

This module exploits a vulnerability found in Auxilium RateMyPet's. The site banner uploading feature can be abused to upload an arbitrary file to the web server, which is accessible in the 'banner' directory, thus allowing remote code execution. Module Options msf use...

MS12-063 Microsoft Internet Explorer execCommand Use-After-Free Vulnerability

This module exploits a vulnerability found in Microsoft Internet Explorer MSIE. When rendering an HTML page, the CMshtmlEd object gets deleted in an unexpected manner, but the same memory is reused again later in the CMshtmlEd::Exec function, leading to a use-after-free condition. Please note tha...

ZEN Load Balancer Filelog Command Execution

This module exploits a vulnerability in ZEN Load Balancer version 2.0 and 3.0-rc1 which could be abused to allow authenticated users to execute arbitrary code under the context of the 'root' user. The 'content2-2.cgi' file uses user controlled data from the 'filelog' parameter within backticks...

Linux Mettle x86, Reverse TCP Stager

Inject the mettle server payload staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- Linux reverse TCP stager. module MetasploitModule CachedSize = 50 include...

Linux Command Shell, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Linux bind TCP stager. module MetasploitModule CachedSize = 63 include Msf::Payload::Stager include...

Linux Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- Linux reverse TCP stager. module MetasploitModule CachedSize = 50 include...

Linux Mettle x86, Bind TCP Stager

Inject the mettle server payload staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Linux bind TCP stager. module MetasploitModule CachedSize = 63 include...

Novell File Reporter Agent Arbitrary File Delete

NFRAgent.exe in Novell File Reporter allows remote attackers to delete arbitrary files via a full pathname in an SRS request with OPERATION set to 4 and CMD set to 5 against /FSF/CMD. This module has been tested successfully on NFR Agent 1.0.4.3 File Reporter 1.0.2 and NFR Agent 1.0.3.22 File...

Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access

This module exploits a directory traversal in Webmin 1.580. The vulnerability exists in the edithtml.cgi component and allows an authenticated user with access to the File Manager Module to access arbitrary files with root privileges. The module has been tested successfully with Webmin 1.580 over...

Webmin /file/show.cgi Remote Command Execution

This module exploits an arbitrary command execution vulnerability in Webmin 1.580. The vulnerability exists in the /file/show.cgi component and allows an authenticated user, with access to the File Manager Module, to execute arbitrary commands with root privileges. The module has been tested...

Windows Manage Remote Packet Capture Service Starter

This module enables the Remote Packet Capture System rpcapd service included in the default installation of Winpcap. The module allows you to set up the service in passive or active mode useful if the client is behind a firewall. If authentication is enabled you need a local user account to captu...

HP SiteScope SOAP Call loadFileContent Remote File Access

This module exploits an authentication bypass vulnerability in HP SiteScope to retrieve an arbitrary text file from the remote server. It is accomplished by calling the loadFileContent operation available through the APIMonitorImpl AXIS service. This module has been successfully tested on HP...

HP SiteScope SOAP Call getSiteScopeConfiguration Configuration Access

This module exploits an authentication bypass vulnerability in HP SiteScope which allows to retrieve the HP SiteScope configuration, including administrative credentials. It is accomplished by calling the getSiteScopeConfiguration operation available through the APISiteScopeImpl AXIS service. The...

HP SiteScope SOAP Call getFileInternal Remote File Access

This module exploits an authentication bypass vulnerability in HP SiteScope to retrieve an arbitrary file from the remote server. It is accomplished by calling the getFileInternal operation available through the APISiteScopeImpl AXIS service. This module has been successfully tested on HP SiteSco...

Microsoft SQL Server Find and Sample Data

This script will search through all of the non-default databases on the SQL Server for columns that match the keywords defined in the TSQL KEYWORDS option. If column names are found that match the defined keywords and data is present in the associated tables, the script will select a sample of th...

Windows Manage Local Microsoft SQL Server Authorization Bypass

When this module is executed, it can be used to add a sysadmin to local SQL Server instances. It first attempts to gain LocalSystem privileges using the "getsystem" escalation methods. If those privileges are not sufficient to add a sysadmin, then it will migrate to the SQL Server service process...

QNX qconn Command Execution

This module uses the qconn daemon on QNX systems to gain a shell. The QNX qconn daemon does not require authentication and allows remote users to execute arbitrary operating system commands. This module has been tested successfully on QNX Neutrino 6.5.0 x86 and 6.5.0 SP1 x86. Module Options msf u...

Openfiler v2.x NetworkCard Command Execution

This module exploits a vulnerability in Openfiler v2.x which could be abused to allow authenticated users to execute arbitrary code under the context of the 'openfiler' user. The 'system.html' file uses user controlled data from the 'device' parameter to create a new 'NetworkCard' object. The cla...

HP System Management Anonymous Access Code Execution

This module exploits an anonymous remote code execution on HP System Management 7.1.1 and earlier. The vulnerability exists when handling the iprange parameter on a request against /proxy/DataValidation. In order to work HP System Management must be configured with Anonymous access enabled. Modul...

HP SiteScope Remote Code Execution

This module exploits a code execution flaw in HP SiteScope. It exploits two vulnerabilities in order to get its objective. An authentication bypass in the create operation, available through the APIPreferenceImpl AXIS service, to create a new account with empty credentials and, subsequently, uses...

HP Application Lifecycle Management XGO.ocx ActiveX SetShapeNodeType() Remote Code Execution

This module exploits a vulnerability within the XGO.ocx ActiveX Control installed with the HP Application Lifecycle Manager Client. The vulnerability exists in the SetShapeNodeType method, which allows the user to specify memory that will be used as an object, through the node parameter. It allow...