UNIX Gather .netrc Credentials

Post Module to obtain credentials saved for FTP and other services in .netrc This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UNIX Gather .netrc Credentials', 'Description' = %q Post Module to...

PcAnywhere TCP Service Discovery

Discover active pcAnywhere services through TCP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PcAnywhere TCP Service Discovery', 'Description' = 'Discover active pcAnywhere services through...

PcAnywhere UDP Service Discovery

Discover active pcAnywhere services through UDP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PcAnywhere UDP Service Discovery', 'Description' = 'Discover active pcAnywhere services through...

Multi Gather VirtualBox VM Enumeration

This module will attempt to enumerate any VirtualBox VMs on the target machine. Due to the nature of VirtualBox, this module can only enumerate VMs registered for the current user, therefore, this module needs to be invoked from a user context. This module requires Metasploit:...

Multi Gather VMWare VM Identification

This module will attempt to find any VMWare virtual machines stored on the target. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'yaml' class MetasploitModule 'Multi Gather VMWare VM Identification',...

NAT-PMP Port Mapper

Map forward TCP and UDP ports on NAT devices using NAT-PMP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NAT-PMP Port Mapper', 'Description' = 'Map forward TCP and UDP ports on NAT devices...

NAT-PMP External Port Scanner

Scan NAT devices for their external listening ports using NAT-PMP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NAT-PMP External Port Scanner', 'Description' = 'Scan NAT devices for their...

NAT-PMP External Address Scanner

Scan NAT devices for their external address using NAT-PMP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NAT-PMP External Address Scanner', 'Description' = 'Scan NAT devices for their external...

Windows Manage Download and/or Execute

This module will download a file by importing urlmon via railgun. The user may also choose to execute the file with arguments via execstring. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

vBSEO proc_deutf() Remote PHP Code Injection

This module exploits a vulnerability in the 'procdeutf' function defined in /includes/functionsvbseocpabstract.php for vBSEO versions 3.6.0 and earlier. User input passed through 'charrepl' POST parameter isn't properly sanitized before being used in a call to pregreplace function which uses the...

VMWare Authentication Daemon Login Scanner

This module will test vmauthd logins on a range of machines and report successful logins. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

PolarBear CMS PHP File Upload Vulnerability

This module exploits a file upload vulnerability found in PolarBear CMS By abusing the upload.php file, a malicious user can upload a file to a temp directory without authentication, which results in arbitrary code execution. Module Options msf use exploit/multi/http/polarcms/uploadexec msf...

Schneider Modicon Quantum Password Recovery

The Schneider Modicon Quantum series of Ethernet cards store usernames and passwords for the system in files that may be retrieved via backdoor access. This module is based on the original 'modiconpass.rb' Basecamp module from DigitalBond. Module Options msf use...

Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands

The EtherNet/IP CIP protocol allows a number of unauthenticated commands to a PLC which implements the protocol. This module implements the CPU STOP command, as well as the ability to crash the Ethernet card in an affected device. This module is based on the original 'ethernetip-multi.rb' Basecam...

Koyo DirectLogic PLC Password Brute Force Utility

This module attempts to authenticate to a locked Koyo DirectLogic PLC. The PLC uses a restrictive passcode, which can be A0000000 through A9999999. The "A" prefix can also be changed by the administrator to any other character, which can be set through the PREFIX option of this module. This modul...

General Electric D20ME TFTP Server Buffer Overflow DoS

By sending a malformed TFTP request to the GE D20ME, it is possible to crash the device. This module is based on the original 'd20ftpbo.rb' Basecamp module from DigitalBond. Module Options msf use auxiliary/dos/scada/d20/tftpoverflow msf undefinedtftpoverflow show actions ...actions... msf...

Gitorious Arbitrary Command Execution

This module exploits an arbitrary command execution vulnerability in gitorious. Unvalidated input is passed to the shell allowing command execution. Module Options msf use exploit/multi/http/gitorious/graph msf undefinedgraph show actions ...actions... msf undefinedgraph set ACTION msf...

General Electric D20 Password Recovery

The General Electric D20ME and possibly other units D200? feature TFTP readable configurations with plaintext passwords. This module retrieves the username, password, and authentication level list. Module Options msf use auxiliary/gather/d20pass msf undefinedd20pass show actions ...actions... msf...

appRain CMF Arbitrary PHP File Upload Vulnerability

This module exploits a vulnerability found in appRain's Content Management Framework CMF, version 0.1.5 or less. By abusing the uploadify.php file, a malicious user can upload a file to the uploads/ directory without any authentication, which results in arbitrary code execution. Module Options ms...

Windows x64 LoadLibrary Path

Load an arbitrary x64 library path This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 285 include Msf::Payload::Windows include Msf::Payload::Single def initializeinfo =...

SonicWALL GMS 6 Arbitrary File Upload

This module exploits a code execution flaw in SonicWALL GMS. It exploits two vulnerabilities in order to get its objective. An authentication bypass in the Web Administration interface allows to abuse the "appliance" application and upload an arbitrary payload embedded in a JSP. The module has be...

Irfanview JPEG2000 jp2 Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version use exploit/windows/fileformat/irfanview/jpeg2000bof msf undefinedjpeg2000bof show actions ...actions... msf undefinedjpeg2000bof set ACTION msf undefinedjpeg2000bof show options ...show and set options... msf...

WebDAV PHP Upload

This module exploits WebDAV which also has PHP enabled, such as found on XAMPP servers. It can use do by using any supplied credentials to upload via WebDAV, a PHP payload and then execute it. Module Options msf use exploit/multi/http/webdav/uploadphp msf undefineduploadphp show actions...

BS.Player 2.57 Buffer Overflow (Unicode SEH)

This module exploits a buffer overflow in BS.Player 2.57. When the playlist import is used to import a specially crafted m3u file, a buffer overflow occurs allowing arbitrary code execution. This module requires Metasploit: https://metasploit.com/download Current source:...

Postgres Schema Dump

This module extracts the schema information from a Postgres server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postgres Schema Dump', 'Description' = % This module extracts the schema...

HP Diagnostics Server magentservice.exe Overflow

This module exploits a stack buffer overflow in HP Diagnostics Server magentservice.exe service. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Originally found and posted by AbdulAziz Harir via ZDI. Module Options msf use...

McAfee SaaS MyCioScan ShowReport Remote Command Execution

This module exploits a vulnerability found in McAfee Security-as-a-Service. The ShowReport function located in the myCIOScn.dll ActiveX component fails to check the FileName argument, and passes it on to a ShellExecuteW function, therefore allows any malicious attacker to execute any process that...

MYSQL Schema Dump

This module extracts the schema information from a MySQL DB server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'yaml' class MetasploitModule 'MYSQL Schema Dump', 'Description' = %Q This module extracts th...

NTR ActiveX Control Check() Method Buffer Overflow

This module exploits a vulnerability found in NTR ActiveX 1.1.8. The vulnerability exists in the Check method, due to the insecure usage of strcat to build a URL using the bstrParams parameter contents note: this is also the reason why the module won't allow you to modify the URIPATH, which leads...

NTR ActiveX Control StopModule() Remote Code Execution

This module exploits a vulnerability found in the NTR ActiveX 1.1.8. The vulnerability exists in the StopModule method, where the lModule parameter is used to dereference memory to get a function pointer, which leads to code execution under the context of the user visiting a malicious web page...

HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution

This module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control HPTicketMgr.dll 2.7.2.0. Code execution can be achieved by first uploading the...

MSSQL Schema Dump

This module attempts to extract the schema from a MSSQL Server Instance. It will disregard builtin and example DBs such as master, model, msdb, and tempdb. The module will create a note for each DB found, and store a YAML formatted output as loot for easy reading. This module requires Metasploit:...

Microsoft Office Word Malicious Macro Execution

This module injects a malicious macro into a Microsoft Office Word document docx. The comments field in the metadata is injected with a Base64 encoded payload, which will be decoded by the macro and execute as a Windows executable. For a successful attack, the victim is required to manually enabl...

MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability

This module exploits a vulnerability found in Microsoft Office's ClickOnce feature. When handling a Macro document, the application fails to recognize certain file extensions as dangerous executables, which can be used to bypass the warning message. This can allow attackers to trick victims into...

MS12-004 midiOutPlayNextPolyEvent Heap Overflow

This module exploits a heap overflow vulnerability in the Windows Multimedia Library winmm.dll. The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using the Windows Media Player ActiveX control. Exploitation is done by supplying a speciall...

AIX Gather Dump Password Hashes

Post Module to dump the password hashes for all users on an AIX System This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AIX Gather Dump Password Hashes', 'Description' = %q Post Module to dump t...

Windows Gather File and Registry Artifacts Enumeration

This module will check the file system and registry for particular artifacts. The list of artifacts is read in YAML format from data/post/enumartifactslist.txt or a user specified file. Any matches are written to the loot. This module requires Metasploit: https://metasploit.com/download Current...

XAMPP WebDAV PHP Upload

This module exploits weak WebDAV passwords on XAMPP servers. It uses supplied credentials to upload a PHP payload and execute it. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'XAMPP WebDAV PH...

MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution

This bug is triggered when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window' JavaScript function. This exploit results in a call to an address lower than the heap. The javascript prompt places our shellcode near where the call operand points...

Apache Struts 2 Developer Mode OGNL Execution

This module exploits a remote command execution vulnerability in Apache Struts 2. The problem exists on applications running in developer mode, where the DebuggingInterceptor allows evaluation and execution of OGNL expressions, which allows remote attackers to execute arbitrary Java code. This...

Apache Struts Remote Command Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/codeexecexceptiondelegator msf undefinedcodeexecexceptiondelegator show actions ...actions... msf undefinedcodeexecexceptiondelegator set ACTION msf...

OP5 license.php Remote Command Execution

This module exploits an arbitrary root command execution vulnerability in the OP5 Monitor license.php. Ekelow has confirmed that OP5 Monitor versions 5.3.5, 5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable. Module Options msf use exploit/multi/http/op5/license msf undefinedlicense show actions...

OP5 welcome Remote Command Execution

This module exploits an arbitrary root command execution vulnerability in OP5 Monitor welcome. Ekelow AB has confirmed that OP5 Monitor versions 5.3.5, 5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable. Module Options msf use exploit/multi/http/op5/welcome msf undefinedwelcome show actions ...actions...

Windows Escalate UAC Execute RunAs

This module will attempt to elevate execution level using the ShellExecute undocumented RunAs flag to bypass low UAC settings. Module Options msf use exploit/windows/local/ask msf undefinedask show actions ...actions... msf undefinedask set ACTION msf undefinedask show options ...show and set...

Windows Manage Mount Shadow Copy

This module will attempt to mount a Volume Shadow Copy on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage Get Shadow Copy Storage Info

This module will attempt to get volume shadow copy storage info. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage List Shadow Copies

This module will attempt to list any Volume Shadow Copies on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage Create Shadow Copy

This module will attempt to create a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage Set Shadow Copy Storage Space

This module will attempt to change the amount of space for volume shadow copy storage. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

CorpWatch Company Name Information Search

This module interfaces with the CorpWatch API to get publicly available info for a given company name. Please note that by using CorpWatch API, you acknowledge the limitations of the data CorpWatch provides, and should always verify the information with the official SEC filings before taking any...