VLC MMS Stream Handling Buffer Overflow

This module exploits a buffer overflow in VLC media player VLC media player prior to 2.0.0. The vulnerability is due to a dangerous use of sprintf which can result in a stack buffer overflow when handling a malicious MMS URI. This module uses the browser as attack vector. A specially crafted MMS...

Linux Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 98 include Msf::Payload::Single include Msf::Payload::Linux::X64::Prepends include...

Linux Gather User History

This module gathers the following user-specific information: shell history, MySQL history, PostgreSQL history, MongoDB history, Vim history, lastlog, and sudoers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Linux Gather System and User Information

This module gathers system information. We collect installed packages, installed services, mount information, user list, user bash history and cron jobs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Linux Gather Network Information

This module gathers network information from the target system IPTables rules, interfaces, wireless information, open and listening ports, active network connections, DNS information and SSH information. This module requires Metasploit: https://metasploit.com/download Current source:...

Sockso Music Host Server 1.5 Directory Traversal

This module exploits a directory traversal bug in Sockso on port 4444. This is done by using "../" in the path to retrieve a file on a vulnerable machine. Module Options msf use auxiliary/scanner/http/sockso/traversal msf undefinedtraversal show actions ...actions... msf undefinedtraversal set...

Apple Filing Protocol Login Utility

This module attempts to bruteforce authentication credentials for AFP. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' require 'metasploit/framework/credentialcollection' require...

HP Data Protector Create New Folder Buffer Overflow

This module exploits a stack buffer overflow in HP Data Protector 5. The overflow occurs in the creation of new folders, where the name of the folder is handled in a insecure way by the dpwindtb.dll component. While the overflow occurs in the stack, the folder name is split in fragments in this...

Xerox Multifunction Printers (MFP) "Patch" DLM Vulnerability

This module exploits a vulnerability found in Xerox Multifunction Printers MFP. By supplying a modified Dynamic Loadable Module DLM, it is possible to execute arbitrary commands under root privileges. Module Options msf use exploit/unix/misc/xerox/mfp msf undefinedmfp show actions ...actions... m...

NetDecision NOCVision Server Directory Traversal

This module exploits a directory traversal bug in NetDecision's TrafficGrapherServer.exe service. This is done by using "..." in the path to retrieve a file on a vulnerable machine. Module Options msf use auxiliary/scanner/http/netdecision/traversal msf undefinedtraversal show actions...

Squid Proxy Port Scanner

A exposed Squid proxy will usually allow an attacker to make requests on their behalf. If misconfigured, this may give the attacker information about devices that they cannot normally reach. For example, an attacker may be able to make requests for internal IP addresses against an open Squid prox...

Apple Filing Protocol Info Enumerator

This module fetches AFP server information, including server name, network address, supported AFP versions, signature, machine type, and server flags. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

HTTP Blind SQL Injection Scanner

This module identifies the existence of Blind SQL injection issues in GET/POST Query parameters values. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Blind SQL Injection Scanner',...

IBM Tivoli Provisioning Manager Express for Software Distribution Isig.isigCtl.1 ActiveX RunAndUploadFile() Method Overflow

This module exploits a buffer overflow vulnerability in the Isig.isigCtl.1 ActiveX installed with IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1. The vulnerability is found in the "RunAndUploadFile" method where the "OtherFields" parameter with user controlled data is use...

Ricoh DC DL-10 SR10 FTP USER Command Buffer Overflow

This module exploits a vulnerability found in Ricoh DC's DL-10 SR10 FTP service. By supplying a long string of data to the USER command, it is possible to trigger a stack-based buffer overflow, which allows remote code execution under the context of the user. Please note that in order to trigger...

MongoDB Login Utility

This module attempts to brute force authentication credentials for MongoDB. Note that, by default, MongoDB does not require authentication. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mongo...

IBM Personal Communications iSeries Access WorkStation 5.9 Profile

The IBM Personal Communications I-Series application WorkStation is susceptible to a stack-based buffer overflow vulnerability within file parsing in which data copied to a location in memory exceeds the size of the reserved destination area. The buffer is located on the runtime program stack. Wh...

Sysax 5.53 SSH Username Buffer Overflow

This module exploits a vulnerability found in Sysax's SSH service. By supplying a long username, the SSH server will copy that data on the stack without proper bounds checking, therefore allowing remote code execution under the context of the user. Please note that previous versions before 5.53 a...

NetDecision 4.5.1 HTTP Server Buffer Overflow

This module exploits a vulnerability found in NetDecision's HTTP service located in C:\Program Files\NetDecision\Bin\HttpSvr.exe. By supplying a long string of data to the URL, an overflow may occur if the data gets handled by HTTP Server's active window. In other words, in order to gain remote...

Lantronix Telnet Service Banner Detection

Detect Lantronix telnet services This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lantronix Telnet Service Banner Detection', 'Description' = 'Detect Lantronix telnet services', 'Author' =...

Csound hetro File Handling Stack Buffer Overflow

This module exploits a buffer overflow in Csound before 5.16.6. The overflow occurs when trying to import a malicious hetro file from tabular format. In order to achieve exploitation the user should import the malicious file through csound with a command like "csound -U hetimport msf.csd file.het...

Novell ZENworks Configuration Management Preboot Service 0x6c Buffer Overflow

This module exploits a remote buffer overflow in the ZENworks Configuration Management. The vulnerability exists in the Preboot service and can be triggered by sending a specially crafted packet with the opcode 0x6c PROXYCMDGETNEXTSTEP to port 998/TCP. The module has been successfully tested on...

Novell ZENworks Configuration Management Preboot Service 0x4c Buffer Overflow

This module exploits a remote buffer overflow in the ZENworks Configuration Management. The vulnerability exists in the Preboot service and can be triggered by sending a specially crafted packet with the opcode 0x4c PROXYCMDPREBOOTTASKINFO2 to port 998/TCP. The module has been successfully tested...

Capture: HTTP JavaScript Keylogger

This modules runs a web server that demonstrates keystroke logging through JavaScript. The DEMO option can be set to enable a page that demonstrates this technique. Future improvements will allow for a configurable template to be used with this module. To use this module with an existing web page...

VNC Authentication Scanner

This module will test a VNC server on a range of machines and report successful logins. Currently it supports RFB protocol version 3.3, 3.7, 3.8 and 4.001 using the VNC challenge response authentication method. This module requires Metasploit: https://metasploit.com/download Current source:...

DB2 Authentication Brute Force Utility

This module attempts to authenticate against a DB2 instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework requi...

Microsoft IIS HTTP Internal IP Disclosure

Collect any leaked internal IPs by requesting commonly redirected locations from IIS. CVE-2000-0649 references IIS 5.1 win2k, XP and older. However, in newer servers such as IIS 7+, this occurs when the alternateHostName is not set or misconfigured. Also collects internal IPs leaked from the...

VMWare Authentication Daemon Version Scanner

This module will identify information about a host through the vmauthd service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Authentication Daemon Version Scanner', 'Description' = %q...

ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow

This module exploits a vulnerability found in ASUS Net4Switch's ipswcom.dll ActiveX control. A buffer overflow condition is possible in multiple places due to the use of the CxDbgPrint function, which allows remote attackers to gain arbitrary code execution under the context of the user. Module...

Windows Escalate SMB Icon LNK Dropper

This module drops a shortcut LNK file that has a ICON reference existing on the specified remote host, causing SMB and WebDAV connections to be initiated from any user that views the shortcut. This module requires Metasploit: https://metasploit.com/download Current source:...

VMWare Enumerate Permissions

This module will log into the Web API of VMWare and try to enumerate all the user/group permissions. Unlike enum users this is only users and groups that specifically have permissions defined within the VMware product This module requires Metasploit: https://metasploit.com/download Current source...

VMWare Tag Virtual Machine

This module will log into the Web API of VMWare and 'tag' a specified Virtual Machine. It does this by logging a user event with user supplied text This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModul...

VMWare Enumerate User Accounts

This module will log into the Web API of VMWare and try to enumerate all the user accounts. If the VMware instance is connected to one or more domains, it will try to enumerate domain users as well. This module requires Metasploit: https://metasploit.com/download Current source:...

VMWare ESX/ESXi Fingerprint Scanner

This module accesses the web API interfaces for VMware ESX/ESXi servers and attempts to identify version information for that server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare...

VMWare Terminate ESX Login Sessions

This module will log into the Web API of VMWare and try to terminate user login sessions as specified by the session keys. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Terminate ESX...

VMWare Enumerate Active Sessions

This module will log into the Web API of VMWare and try to enumerate all the login sessions. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Enumerate Active Sessions', 'Description' = %...

VMWare Power Off Virtual Machine

This module will log into the Web API of VMWare and try to power off a specified Virtual Machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Power Off Virtual Machine', 'Description...

VMWare Power On Virtual Machine

This module will log into the Web API of VMWare and try to power on a specified Virtual Machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Power On Virtual Machine', 'Description' ...

LANDesk Lenovo ThinkManagement Console Remote Command Execution

This module can be used to execute a payload on LANDesk Lenovo ThinkManagement Suite 9.0.2 and 9.0.3. The payload is uploaded as an ASP script by sending a specially crafted SOAP request to "/landesk/managementsuite/core/core.anonymous/ServerSetup.asmx" , via a "RunAMTCommand" operation with the...

Adobe Flash Player MP4 'cprt' Overflow

This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt .mp4 file loaded by Flash, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "Iran's Oil and Nuclear...

Java AtomicReferenceArray Type Violation Vulnerability

This module exploits a vulnerability due to the fact that AtomicReferenceArray uses the Unsafe class to store a reference in an array directly, which may violate type safety if not used properly. This allows a way to escape the JRE sandbox, and load additional classes in order to perform maliciou...

Sun Java Web Start Plugin Command Line Argument Injection

This module exploits a flaw in the Web Start component of the Sun Java Runtime Environment. The arguments passed to Java Web Start are not properly validated, allowing injection of arbitrary arguments to the JVM. By utilizing the lesser known -J option, an attacker can take advantage of the...

VMWare Enumerate Virtual Machines

This module attempts to discover virtual machines on any VMWare instance running the web interface. This would include ESX/ESXi and VMWare Server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

VMWare Screenshot Stealer

This module uses supplied login credentials to connect to VMWare via the web interface. It then searches through the datastores looking for screenshots. It will download any screenshots it finds and save them as loot. This module requires Metasploit: https://metasploit.com/download Current source...

VMWare Web Login Scanner

This module attempts to authenticate to the VMWare HTTP service for VmWare Server, ESX, and ESXI This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VMWare Web Login Scanner', 'Description' = 'This...

Horde 3.3.12 Backdoor Arbitrary PHP Code Execution

This module exploits an arbitrary PHP code execution vulnerability introduced as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10. Module Options msf use exploit/multi/http/horde/hrefbackdoor msf undefinedhrefbackdoor show actions ...actions... msf undefinedhrefbackdoor set ACTION msf...

UNIX Gather .fetchmailrc Credentials

Post Module to obtain credentials saved for IMAP, POP and other mail retrieval protocols in fetchmail's .fetchmailrc This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UNIX Gather .fetchmailrc...

RabidHamster R4 Log Entry sprintf() Buffer Overflow

This module exploits a vulnerability found in RabidHamster R4's web server. By supplying a malformed HTTP request, it is possible to trigger a stack-based buffer overflow when generating a log, which may result in arbitrary code execution under the context of the user. Module Options msf use...

Windows Gather Microsoft Outlook Saved Password Extraction

This module extracts and decrypts saved Microsoft Outlook versions 2002-2010 passwords from the Windows Registry for POP3/IMAP/SMTP/HTTP accounts. In order for decryption to be successful, this module must be executed under the same privileges as the user which originally encrypted the password. ...

Windows Gather VNC Password Extraction

This module extract DES encrypted passwords in known VNC locations This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather VNC Password Extraction', 'Description' = %q This module extrac...