PHP Volunteer Management System v1.0.2 Arbitrary File Upload Vulnerability

This module exploits a vulnerability found in PHP Volunteer Management System, version v1.0.2 or prior. This application has an upload feature that allows an authenticated user to upload anything to the 'uploads' directory, which is actually reachable by anyone without a credential. An attacker c...

WordPress Asset-Manager PHP File Upload Vulnerability

This module exploits a vulnerability found in Asset-Manager use exploit/unix/webapp/wp/assetmanageruploadexec msf undefinedassetmanageruploadexec show actions ...actions... msf undefinedassetmanageruploadexec set ACTION msf undefinedassetmanageruploadexec show options ...show and set options... m...

IBM Lotus QuickR qp2 ActiveX Buffer Overflow

This module exploits a buffer overflow vulnerability on the UploadControl ActiveX. The vulnerability exists in the handling of the "AttachmentTimes" property, due to the insecure usage of the swscanf. The affected ActiveX is provided by the qp2.dll installed with the IBM Lotus Quickr product. Thi...

OS X Text to Speech Utility

This module will speak whatever is in the 'TEXT' option on the victim machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OS X Text to Speech Utility', 'Description' = %q This module will...

Windows Manage PowerShell Download and/or Execute

This module will download and execute a PowerShell script over a meterpreter session. The user may also enter text substitutions to be made in memory before execution. Setting VERBOSE to true will output both the script prior to execution and the results. This module requires Metasploit:...

IBM Rational ClearQuest CQOle Remote Code Execution

This module exploits a function prototype mismatch on the CQOle ActiveX control in IBM Rational ClearQuest use exploit/windows/browser/clear/questcqole msf undefinedquestcqole show actions ...actions... msf undefinedquestcqole set ACTION msf undefinedquestcqole show options ...show and set...

GIMP script-fu Server Buffer Overflow

This module exploits a buffer overflow in the script-fu server component on GIMP use exploit/windows/misc/gimp/scriptfu msf undefinedscriptfu show actions ...actions... msf undefinedscriptfu set ACTION msf undefinedscriptfu show options ...show and set options... msf undefinedscriptfu run This...

Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability

This module exploits a file upload vulnerability found in Symantec Web Gateway's HTTP service. Due to the incorrect use of file extensions in the uploadfile function, attackers may to abuse the spywall/blockedfile.php file in order to upload a malicious PHP file without any authentication, which...

Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection

This module exploits a command injection vulnerability found in Symantec Web Gateway's HTTP service due to the insecure usage of the exec function. This module abuses the spywall/ipchange.php file to execute arbitrary OS commands without authentication. Module Options msf use...

Symantec Web Gateway 5.0.2.8 relfile File Inclusion Vulnerability

This module exploits a vulnerability found in Symantec Web Gateway's HTTP service. By injecting PHP code in the access log, it is possible to load it with a directory traversal flaw, which allows remote code execution under the context of 'apache'. Please note that it may take up to several minut...

Lattice Semiconductor ispVM System XCF File Handling Overflow

This module exploits a vulnerability found in ispVM System 18.0.2. Due to the way ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially crafted file, when a long value is supplied for the version attribute of the ispXCF tag. It results in arbitrary code execution...

Lattice Semiconductor PAC-Designer 6.21 Symbol Value Buffer Overflow

This module exploits a vulnerability found in Lattice Semiconductor PAC-Designer 6.21. As a .pac file, when supplying a long string of data to the 'value' field under the 'SymbolicSchematicData' tag, it is possible to cause a memory corruption on the stack, which results in arbitrary code executi...

CCTV DVR Login Scanning Utility

This module tests for standalone CCTV DVR video surveillance deployments specifically by MicroDigital, HIVISION, CTRing, and numerous other rebranded devices that are utilizing default vendor passwords. Additionally, this module has the ability to brute force user accounts. Such CCTV DVR video...

Apple QuickTime TeXML Style Element Stack Buffer Overflow

This module exploits a vulnerability found in Apple QuickTime. When handling a TeXML file, it is possible to trigger a stack-based buffer overflow, and then gain arbitrary code execution under the context of the user. This is due to the QuickTime3GPP.gtx component not handling certain Style...

Windows Gather Local User Account Password Hashes (Registry)

This module will dump the local user accounts from the SAM database using the registry This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Gather Local User Account Passwo...

Cisco Secure ACS Unauthorized Password Change

This module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

RuggedCom Telnet Password Generator

This module will calculate the password for the hard-coded hidden username "factory" in the RuggedCom Rugged Operating System ROS. The password is dynamically generated based on the devices MAC address. This module requires Metasploit: https://metasploit.com/download Current source:...

Squiggle 1.7 SVG Browser Java Code Execution

This module abuses the SVG support to execute Java Code in the Squiggle Browser included in the Batik framework 1.7 through a crafted SVG file referencing a jar file. In order to gain arbitrary code execution, the browser must meet the following conditions: 1 It must support at least SVG version...

SAP SOAP RFC SXPG_COMMAND_EXECUTE Remote Command Execution

This module abuses the SAP NetWeaver SXPGCOMMANDEXECUTE function, on the SAP SOAP RFC Service, to execute remote commands. This module needs SAP credentials with privileges to use the /sap/bc/soap/rfc in order to work. The module has been tested successfully on Windows 2008 64-bit and Linux 64-bi...

PHP apache_request_headers Function Buffer Overflow

This module exploits a stack based buffer overflow in the CGI version of PHP 5.4.x before 5.4.3. The vulnerability is due to the insecure handling of the HTTP headers. This module has been tested against the thread safe version of PHP 5.4.2, from "windows.php.net", running with Apache 2.2.22 from...

SAP NetWeaver Dispatcher DiagTraceR3Info Buffer Overflow

This module exploits a stack buffer overflow in the SAP NetWeaver Dispatcher service. The overflow occurs in the DiagTraceR3Info function and allows a remote attacker to execute arbitrary code by supplying a special crafted Diag packet. The Dispatcher service is only vulnerable if the Developer...

Adobe Flash Player Object Type Confusion

This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt AMF0 "error" response, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "World Uyghur Congress...

PHP CGI Argument Injection

When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in the query string, the string is split on...

McAfee Virtual Technician MVTControl 6.3.0.1911 GetObject Vulnerability

This module exploits a vulnerability found in McAfee Virtual Technician's MVTControl. This ActiveX control can be abused by using the GetObject function to load additional unsafe classes such as WScript.Shell, therefore allowing remote code execution under the context of the user. Module Options...

InduSoft Web Studio ISSymbol.ocx InternationalSeparator() Heap Overflow

This module exploits a heap overflow found in InduSoft Web Studio use exploit/windows/browser/indusoft/issymbolinternationalseparator msf undefinedissymbolinternationalseparator show actions ...actions... msf undefinedissymbolinternationalseparator set ACTION msf...

Multi Generic Operating System Session Command Execution

This module executes an arbitrary command line This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Generic Operating System Session Command Execution', 'Description' = %q This module executes...

WebCalendar 1.2.4 Pre-Auth Remote Code Injection

This module exploits a vulnerability found in k5n.us WebCalendar, version 1.2.4 or less. If not removed, the settings.php script meant for installation can be update by an attacker, and then inject code in it. This allows arbitrary code execution as www-data. Module Options msf use...

UDP Wake-On-Lan (WOL)

This module will turn on a remote machine with a network card that supports wake-on-lan or MagicPacket. In order to use this, you must know the machine's MAC address in advance. The current default MAC address is just an example of how your input should look like. The password field is optional. ...

Samsung NET-i Viewer Multiple ActiveX BackupToAvi() Remote Overflow

This module exploits a vulnerability in the CNCCtrl.dll ActiveX control installed with the Samsung NET-i viewer 1.37. Specifically, when supplying a long string for the fname parameter to the BackupToAvi method, an integer overflow occurs, which leads to a posterior buffer overflow due to the use...

V-CMS Login Utility

This module attempts to authenticate to an English-based V-CMS login interface. It should only work against version v1.1 or older, because these versions do not have any default protections against brute forcing. This module requires Metasploit: https://metasploit.com/download Current source:...

Oracle AutoVue ActiveX Control SetMarkupMode Buffer Overflow

This module exploits a vulnerability found in the AutoVue.ocx ActiveX control. The vulnerability, due to the insecure usage of an strcpy like function in the SetMarkupMode method, when handling a specially crafted sMarkup argument, allows to trigger a stack based buffer overflow which leads to co...

Oracle TNS Listener Checker

This module checks the server for vulnerabilities like TNS Poison. Module sends a server a packet with command to register new TNS Listener and checks for a response indicating an error. If the registration is errored, the target is not vulnerable. Otherwise, the target is vulnerable to malicious...

John the Ripper MySQL Password Cracker (Fast Mode)

This module uses John the Ripper to identify weak passwords that have been acquired from the mysqlhashdump module. Passwords that have been successfully cracked are then saved as proper credentials...

Samba SetInformationPolicy AuditEventsInfo Heap Overflow

This module triggers a vulnerability in the LSA RPC service of the Samba daemon because of an error on the PIDL auto-generated code. Making a specially crafted call to SetInformationPolicy to set a PolicyAuditEventsInformation allows to trigger a heap overflow and finally execute arbitrary code...

MS12-027 MSCOMCTL ActiveX Buffer Overflow

This module exploits a stack buffer overflow in MSCOMCTL.OCX. It uses a malicious RTF to embed the specially crafted MSComctlLib.ListViewCtrl.2 Control as exploited in the wild on April 2012. This module targets Office 2007 and Office 2010 targets. The DEP/ASLR bypass on Office 2010 is done with...

Dolibarr ERP/CRM Login Utility

This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface, and should only work against version 3.1.1 or older, because these versions do not have any default protections against brute forcing. This module requires Metasploit: https://metasploit.com/download Current source:...

Distinct TFTP 3.10 Writable Directory Traversal Execution

This module exploits a directory traversal vulnerability in the TFTP Server component of Distinct Intranet Servers version 3.10 which allows a remote attacker to write arbitrary files to the server file system, resulting in code execution under the context of 'SYSTEM'. This module has been tested...

ICMP Exfiltration Service

This module is designed to provide a server-side component to receive and store files exfiltrated over ICMP echo request packets. To use this module you will need to send an initial ICMP echo request containing the specific start trigger defaults to '^BOF' this can be followed by the filename bei...

Dolibarr ERP/CRM Post-Auth OS Command Injection

This module exploits a vulnerability found in Dolibarr ERP/CRM 3's backup feature. This software is used to manage a company's business information such as contacts, invoices, orders, stocks, agenda, etc. When processing a database backup request, the export.php function does not check the input...

Schneider Modicon Ladder Logic Upload/Download

The Schneider Modicon with Unity series of PLCs use Modbus function code 90 0x5a to send and receive ladder logic. The protocol is unauthenticated, and allows a rogue host to retrieve the existing logic and to upload new logic. Two modes are supported: "SEND" and "RECV," which behave as one might...

Schneider Modicon Remote START/STOP Command

The Schneider Modicon with Unity series of PLCs use Modbus function code 90 0x5a to perform administrative commands without authentication. This module allows a remote user to change the state of the PLC between STOP and RUN, allowing an attacker to end process control by the PLC. This module is...

BlazeVideo HDTV Player Pro v6.6 Filename Handling Vulnerability

This module exploits a vulnerability found in BlazeVideo HDTV Player's filename handling routine. When supplying a string of input data embedded in a .plf file, the MediaPlayerCtrl.dll component will try to extract a filename by using PathFindFileNameA, and then copies whatever the return value i...

IBM Cognos tm1admsd.exe Overflow

This module exploits a stack buffer overflow in IBM Cognos Analytic Server Admin service. The vulnerability exists in the tm1admsd.exe component, due to a dangerous copy of user controlled data to the stack, via memcpy, without validating the supplied length and data. The module has been tested...

Th3 MMA mma.php Backdoor Arbitrary File Upload

This module exploits Th3 MMA mma.php Backdoor which allows an arbitrary file upload that leads to arbitrary code execution. This backdoor also echoes the Linux kernel version or operating system version because of the phpuname function. Module Options msf use exploit/multi/http/mma/backdoorupload...

Periodic Script Persistence

This module will achieve persistence by writing a script to the /etc/periodic directory. According to The Art of Mac Malware no such malware species persist in this manner 2024. This payload requires root privileges to run. This module can be run on BSD, OSX or Arch Linux. Module Options msf use...

Mac OS X Persistent Payload Installer

This module provides a persistent boot payload by creating a launch item, which can be a LaunchAgent or a LaunchDaemon. LaunchAgents run with user level permissions and are triggered upon login by a plist entry in /Library/LaunchAgents. LaunchDaemons run with elevated privilleges, and are launche...

Aladdin Knowledge System Ltd ChooseFilePath Buffer Overflow

This module exploits a vulnerability found in Aladdin Knowledge System's ActiveX component. By supplying a long string of data to the ChooseFilePath function, a buffer overflow occurs, which may result in remote code execution under the context of the user. Module Options msf use...

Linux Gather XChat Enumeration

This module will collect XChat's config files and chat logs from the victim's machine. There are three actions you may choose: CONFIGS, CHATS, and ALL. The CONFIGS option can be used to collect information such as channel settings, channel/server passwords, etc. The CHATS option will simply...

OS X Gather Colloquy Enumeration

This module will collect Colloquy's info plist file and chat logs from the victim's machine. There are three actions you may choose: INFO, CHATS, and ALL. Please note that the CHAT action may take a long time depending on the victim machine, therefore we suggest to set the regex 'PATTERN' option ...

OS X Gather Airport Wireless Preferences

This module will download OS X Airport Wireless preferences from the victim machine. The preferences file which is a plist contains information such as: SSID, Channels, Security Type, Password ID, etc. This module requires Metasploit: https://metasploit.com/download Current source:...