Atlassian Crowd XML Entity Expansion Remote File Access

This module simply attempts to read a remote file from the server using a vulnerability in the way Atlassian Crowd handles XML files. The vulnerability occurs while trying to expand external entities with the SYSTEM identifier. This module has been tested successfully on Linux and Windows...

Network Shutdown Module (sort_values) Remote PHP Code Injection

This module exploits a vulnerability in Eaton Network Shutdown Module version use exploit/multi/http/eaton/nsmcodeexec msf undefinednsmcodeexec show actions ...actions... msf undefinednsmcodeexec set ACTION msf undefinednsmcodeexec show options ...show and set options... msf undefinednsmcodeexec...

KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability

This module exploits a code execution vulnerability in the KeyScript ActiveX control from keyhelp.ocx. It is packaged in several products or GE, such as Proficy Historian 4.5, 4.0, 3.5, and 3.1, Proficy HMI/SCADA 5.1 and 5.0, Proficy Pulse 1.0, Proficy Batch Execution 5.6, and SI7 I/O Driver...

Network Shutdown Module sort_values Credential Dumper

This module will extract user credentials from Network Shutdown Module versions 3.21 and earlier by exploiting a vulnerability found in lib/dbtools.inc, which uses unsanitized user input inside a eval call. Please note that in order to extract credentials, the vulnerable service must have at leas...

LLMNR Spoofer

LLMNR Link-local Multicast Name Resolution is the successor of NetBIOS Windows Vista and up and is used to resolve the names of neighboring computers. This module forges LLMNR responses by listening for LLMNR requests sent to the LLMNR multicast address 224.0.0.252 and responding with a...

Poison Ivy Server Buffer Overflow

This module exploits a stack buffer overflow in the Poison Ivy 2.2.0 to 2.3.2 C&C server. The exploit does not need to know the password chosen for the bot/server communication. Module Options msf use exploit/windows/misc/poisonivy/bof msf undefinedbof show actions ...actions... msf undefinedbof...

SugarCRM unserialize() PHP Code Execution

This module exploits a php unserialize vulnerability in SugarCRM use exploit/unix/webapp/sugarcrm/unserializeexec msf undefinedunserializeexec show actions ...actions... msf undefinedunserializeexec set ACTION msf undefinedunserializeexec show options ...show and set options... msf...

Windows Gather Generic File Collection

This module downloads files recursively based on the FILEGLOBS option. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Generic File Collection', 'Description' = %q This module...

Adobe Flash Player AVM Verification Logic Array Indexing Code Execution

This module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JITJust-In-Time code being executed. This is the same vulnerability that was used for attacks against...

Apple iTunes 10 Extended M3U Stack Buffer Overflow

This module exploits a stack buffer overflow in iTunes 10.4.0.80 to 10.6.1.7. When opening an extended .m3u file containing an "EXTINF:" tag description, iTunes will copy the content after "EXTINF:" without appropriate checking from a heap buffer to a stack buffer, writing beyond the stack buffer...

Windows Gather TortoiseSVN Saved Password Extraction

This module extracts and decrypts saved TortoiseSVN passwords. In order for decryption to be successful this module must be executed under the same privileges as the user which originally encrypted the password. This module requires Metasploit: https://metasploit.com/download Current source:...

EZHomeTech EzServer Stack Buffer Overflow Vulnerability

This module exploits a stack buffer overflow in the EZHomeTech EZServer for versions 6.4.017 and earlier. If a malicious user sends packets containing an overly long string, it may be possible to execute a payload remotely. Due to size constraints, this module uses the Egghunter technique. Module...

Open-FTPD 1.2 Arbitrary File Upload

This module exploits multiple vulnerabilities found in Open&Compact FTP server. The software contains an authentication bypass vulnerability and a arbitrary file upload vulnerability that allows a remote attacker to write arbitrary files to the file system as long as there is at least one user wh...

IBM Lotus Notes Client URL Handler Command Injection

This module exploits a command injection vulnerability in the URL handler for for the IBM Lotus Notes Client use exploit/windows/browser/notes/handlercmdinject msf undefinedhandlercmdinject show actions ...actions... msf undefinedhandlercmdinject set ACTION msf undefinedhandlercmdinject show...

Avoid underscore/tolower

Underscore/tolower Safe Encoder used to exploit CVE-2012-2329. It is a modified version of the 'Avoid UTF8/tolower' encoder by skape. Please check the documentation of the skape encoder before using it. As the original, this encoder expects ECX pointing to the start of the encoded payload. Also...

qdPM v7 Arbitrary PHP File Upload Vulnerability

This module exploits a vulnerability found in qdPM - a web-based project management software. The user profile's photo upload feature can be abused to upload any arbitrary file onto the victim server machine, which allows remote code execution. Please note in order to use this module, you must ha...

MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow

This module exploits a heap overflow vulnerability in Internet Explorer caused by an incorrect handling of the span attribute for col elements from a fixed table, when they are modified dynamically by javascript code. Module Options msf use exploit/windows/browser/ms12/037iecolspan msf...

FreeBSD Intel SYSRET Privilege Escalation

This module exploits a vulnerability in the FreeBSD kernel, when running on 64-bit Intel processors. By design, 64-bit processors following the X86-64 specification will trigger a general protection fault GPF when executing a SYSRET instruction with a non-canonical address in the RCX register...

MS12-037 Microsoft Internet Explorer Same ID Property Deleted Object Handling Memory Corruption

This module exploits a memory corruption flaw in Internet Explorer 8 when handling objects with the same ID property. At the moment this module targets IE8 over Windows XP SP3 and Windows 7. This module supports heap massaging as well as the heap spray method seen in the wild Java msvcrt71.dll...

MS12-043 Microsoft XML Core Services MSXML Uninitialized Memory Corruption

This module exploits a memory corruption flaw in Microsoft XML Core Services when trying to access an uninitialized Node with the getDefinition API, which may corrupt memory allowing remote code execution. Module Options msf use exploit/windows/browser/msxml/getdefinitioncodeexec msf...

Free Float FTP Server USER Command Buffer Overflow

Freefloat FTP Server is prone to an overflow condition. It fails to properly sanitize user-supplied input resulting in a stack-based buffer overflow. With a specially crafted 'USER' command, a remote attacker can potentially have an unspecified impact. Module Options msf use...

F5 BIG-IP SSH Private Key Exposure

F5 ships a public/private key pair on BIG-IP appliances that allows passwordless authentication to any other BIG-IP box. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. Module Options msf use exploit/linux/ssh/f5/bigipknownprivkey msf...

Linux Read File

Read up to 4096 bytes from the local file system and write it back out to the specified file descriptor This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 63 include...

MySQL Authentication Bypass Password Dump

This module exploits a password bypass vulnerability in MySQL in order to extract the usernames and encrypted password hashes from a MySQL server. These hashes are stored as loot for later cracking. Impacts MySQL versions: - 5.1.x before 5.1.63 - 5.5.x before 5.5.24 - 5.6.x before 5.6.6 And Maria...

ComSndFTP v1.3.7 Beta USER Format String (Write4) Vulnerability

This module exploits the ComSndFTP FTP Server version 1.3.7 beta by sending a specially crafted format string specifier as a username. The crafted username is sent to the server to overwrite the hardcoded function pointer from Ws232.dll!WSACleanup. Once this function pointer is triggered, the cod...

Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow

This module exploits a stack-based buffer overflow in Photodex ProShow Producer v5.0.3256 in the handling of the plugins load list file. An attacker must send the crafted "load" file to victim, who must store it in the installation directory. The vulnerability will be triggered the next time...

Java Applet Field Bytecode Verifier Cache Remote Code Execution

This module exploits a vulnerability in HotSpot bytecode verifier where an invalid optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient type checks. This allows a way to escape the JRE sandbox, and load additional classes in order to perform malicious operation...

Multi Gather Skype User Data Enumeration

This module will enumerate Skype account settings, contact list, call history, chat logs, file transfer history, and voicemail logs, saving all the data to CSV files for analysis. This module requires Metasploit: https://metasploit.com/download Current source:...

WordPress Plugin Foxypress uploadify.php Arbitrary Code Execution

This module exploits an arbitrary PHP code execution flaw in the WordPress blogging software plugin known as Foxypress. The vulnerability allows for arbitrary file upload and remote code execution via the uploadify.php script. The Foxypress plugin versions 0.4.1.1 to 0.4.2.1 are vulnerable. Modul...

Sielco Sistemi Winlog Buffer Overflow 2.07.14 - 2.07.16

This module exploits a buffer overflow in Sielco Sistem Winlog use exploit/windows/scada/winlog/runtime2 msf undefinedruntime2 show actions ...actions... msf undefinedruntime2 set ACTION msf undefinedruntime2 show options ...show and set options... msf undefinedruntime2 run This module requires...

IBM Lotus iNotes dwa85W ActiveX Buffer Overflow

This module exploits a buffer overflow vulnerability on the UploadControl ActiveX. The vulnerability exists in the handling of the "AttachmentTimes" property, due to the insecure usage of the swscanf. The affected ActiveX is provided by the dwa85W.dll installed with the IBM Lotus iNotes ActiveX...

PcAnywhere Login Scanner

This module will test pcAnywhere logins on a range of machines and report successful logins. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PcAnywhere Login Scanner', 'Description' = %q This...

Active Collab "chat module" Remote PHP Code Injection Exploit

This module exploits an arbitrary code injection vulnerability in the chat module that is part of Active Collab versions 2.3.8 and earlier by abusing a pregreplace using the /e modifier and its replacement string using double quotes. The vulnerable function can be found in...

PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability

This module exploits a vulnerability found in PHP Volunteer Management System, version v1.0.2 or prior. This application has an upload feature that allows an authenticated user to upload anything to the 'uploads' directory, which is actually reachable by anyone without a credential. An attacker c...

WordPress Asset-Manager PHP File Upload Vulnerability

This module exploits a vulnerability found in Asset-Manager use exploit/unix/webapp/wp/assetmanageruploadexec msf undefinedassetmanageruploadexec show actions ...actions... msf undefinedassetmanageruploadexec set ACTION msf undefinedassetmanageruploadexec show options ...show and set options... m...

IBM Lotus QuickR qp2 ActiveX Buffer Overflow

This module exploits a buffer overflow vulnerability on the UploadControl ActiveX. The vulnerability exists in the handling of the "AttachmentTimes" property, due to the insecure usage of the swscanf. The affected ActiveX is provided by the qp2.dll installed with the IBM Lotus Quickr product. Thi...

OS X Text to Speech Utility

This module will speak whatever is in the 'TEXT' option on the victim machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OS X Text to Speech Utility', 'Description' = %q This module will...

Windows Manage PowerShell Download and/or Execute

This module will download and execute a PowerShell script over a meterpreter session. The user may also enter text substitutions to be made in memory before execution. Setting VERBOSE to true will output both the script prior to execution and the results. This module requires Metasploit:...

IBM Rational ClearQuest CQOle Remote Code Execution

This module exploits a function prototype mismatch on the CQOle ActiveX control in IBM Rational ClearQuest use exploit/windows/browser/clear/questcqole msf undefinedquestcqole show actions ...actions... msf undefinedquestcqole set ACTION msf undefinedquestcqole show options ...show and set...

GIMP script-fu Server Buffer Overflow

This module exploits a buffer overflow in the script-fu server component on GIMP use exploit/windows/misc/gimp/scriptfu msf undefinedscriptfu show actions ...actions... msf undefinedscriptfu set ACTION msf undefinedscriptfu show options ...show and set options... msf undefinedscriptfu run This...

Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability

This module exploits a file upload vulnerability found in Symantec Web Gateway's HTTP service. Due to the incorrect use of file extensions in the uploadfile function, attackers may to abuse the spywall/blockedfile.php file in order to upload a malicious PHP file without any authentication, which...

Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability

This module exploits a vulnerability found in Symantec Web Gateway's HTTP service. By injecting PHP code in the access log, it is possible to load it with a directory traversal flaw, which allows remote code execution under the context of 'apache'. Please note that it may take up to several minut...

Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection

This module exploits a command injection vulnerability found in Symantec Web Gateway's HTTP service due to the insecure usage of the exec function. This module abuses the spywall/ipchange.php file to execute arbitrary OS commands without authentication. Module Options msf use...

Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow

This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer 6.21. As a .pac file, when supplying a long string of data to the 'value' field under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption on the stack, which results in arbitrary code executi...

Lattice Semiconductor ispVM System XCF File Handling Overflow

This module exploits a vulnerability found in ispVM System 18.0.2. Due to the way ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially crafted file, when a long value is supplied for the version attribute of the ispXCF tag. It results in arbitrary code execution...

CCTV DVR Login Scanning Utility

This module tests for standalone CCTV DVR video surveillance deployments specifically by MicroDigital, HIVISION, CTRing, and numerous other rebranded devices that are utilizing default vendor passwords. Additionally, this module has the ability to brute force user accounts. Such CCTV DVR video...

Apple QuickTime TeXML Style Element Stack Buffer Overflow

This module exploits a vulnerability found in Apple QuickTime. When handling a TeXML file, it is possible to trigger a stack-based buffer overflow, and then gain arbitrary code execution under the context of the user. This is due to the QuickTime3GPP.gtx component not handling certain Style...

Windows Gather Local User Account Password Hashes (Registry)

This module will dump the local user accounts from the SAM database using the registry This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Gather Local User Account Passwo...

Cisco Secure ACS Unauthorized Password Change

This module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

RuggedCom Telnet Password Generator

This module will calculate the password for the hard-coded hidden username "factory" in the RuggedCom Rugged Operating System ROS. The password is dynamically generated based on the devices MAC address. This module requires Metasploit: https://metasploit.com/download Current source:...