Windows x64 LoadLibrary Path

Load an arbitrary x64 library path This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 285 include Msf::Payload::Windows include Msf::Payload::Single def initializeinfo =...

SonicWALL GMS 6 Arbitrary File Upload

This module exploits a code execution flaw in SonicWALL GMS. It exploits two vulnerabilities in order to get its objective. An authentication bypass in the Web Administration interface allows to abuse the "appliance" application and upload an arbitrary payload embedded in a JSP. The module has be...

Irfanview JPEG2000 jp2 Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version use exploit/windows/fileformat/irfanview/jpeg2000bof msf undefinedjpeg2000bof show actions ...actions... msf undefinedjpeg2000bof set ACTION msf undefinedjpeg2000bof show options ...show and set options... msf...

WebDAV PHP Upload

This module exploits WebDAV which also has PHP enabled, such as found on XAMPP servers. It can use do by using any supplied credentials to upload via WebDAV, a PHP payload and then execute it. Module Options msf use exploit/multi/http/webdav/uploadphp msf undefineduploadphp show actions...

BS.Player 2.57 Buffer Overflow (Unicode SEH)

This module exploits a buffer overflow in BS.Player 2.57. When the playlist import is used to import a specially crafted m3u file, a buffer overflow occurs allowing arbitrary code execution. This module requires Metasploit: https://metasploit.com/download Current source:...

Postgres Schema Dump

This module extracts the schema information from a Postgres server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postgres Schema Dump', 'Description' = % This module extracts the schema...

HP Diagnostics Server magentservice.exe Overflow

This module exploits a stack buffer overflow in HP Diagnostics Server magentservice.exe service. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Originally found and posted by AbdulAziz Harir via ZDI. Module Options msf use...

McAfee SaaS MyCioScan ShowReport Remote Command Execution

This module exploits a vulnerability found in McAfee Security-as-a-Service. The ShowReport function located in the myCIOScn.dll ActiveX component fails to check the FileName argument, and passes it on to a ShellExecuteW function, therefore allows any malicious attacker to execute any process that...

MYSQL Schema Dump

This module extracts the schema information from a MySQL DB server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'yaml' class MetasploitModule 'MYSQL Schema Dump', 'Description' = %Q This module extracts th...

NTR ActiveX Control Check() Method Buffer Overflow

This module exploits a vulnerability found in NTR ActiveX 1.1.8. The vulnerability exists in the Check method, due to the insecure usage of strcat to build a URL using the bstrParams parameter contents note: this is also the reason why the module won't allow you to modify the URIPATH, which leads...

NTR ActiveX Control StopModule() Remote Code Execution

This module exploits a vulnerability found in the NTR ActiveX 1.1.8. The vulnerability exists in the StopModule method, where the lModule parameter is used to dereference memory to get a function pointer, which leads to code execution under the context of the user visiting a malicious web page...

HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution

This module allows remote attackers to place arbitrary files on a users file system by abusing the "CacheDocumentXMLWithId" method from the "XMLCacheMgr" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control HPTicketMgr.dll 2.7.2.0. Code execution can be achieved by first uploading the...

MSSQL Schema Dump

This module attempts to extract the schema from a MSSQL Server Instance. It will disregard builtin and example DBs such as master, model, msdb, and tempdb. The module will create a note for each DB found, and store a YAML formatted output as loot for easy reading. This module requires Metasploit:...

Microsoft Office Word Malicious Macro Execution

This module injects a malicious macro into a Microsoft Office Word document docx. The comments field in the metadata is injected with a Base64 encoded payload, which will be decoded by the macro and execute as a Windows executable. For a successful attack, the victim is required to manually enabl...

MS12-004 midiOutPlayNextPolyEvent Heap Overflow

This module exploits a heap overflow vulnerability in the Windows Multimedia Library winmm.dll. The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using the Windows Media Player ActiveX control. Exploitation is done by supplying a speciall...

MS12-005 Microsoft Office ClickOnce Unsafe Object Package Handling Vulnerability

This module exploits a vulnerability found in Microsoft Office's ClickOnce feature. When handling a Macro document, the application fails to recognize certain file extensions as dangerous executables, which can be used to bypass the warning message. This can allow attackers to trick victims into...

AIX Gather Dump Password Hashes

Post Module to dump the password hashes for all users on an AIX System This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AIX Gather Dump Password Hashes', 'Description' = %q Post Module to dump t...

Windows Gather File and Registry Artifacts Enumeration

This module will check the file system and registry for particular artifacts. The list of artifacts is read in YAML format from data/post/enumartifactslist.txt or a user specified file. Any matches are written to the loot. This module requires Metasploit: https://metasploit.com/download Current...

XAMPP WebDAV PHP Upload

This module exploits weak WebDAV passwords on XAMPP servers. It uses supplied credentials to upload a PHP payload and execute it. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'XAMPP WebDAV PH...

MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution

This bug is triggered when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window' JavaScript function. This exploit results in a call to an address lower than the heap. The javascript prompt places our shellcode near where the call operand points...

Apache Struts Remote Command Execution

This module exploits a remote command execution vulnerability in Apache Struts versions use exploit/multi/http/struts/codeexecexceptiondelegator msf undefinedcodeexecexceptiondelegator show actions ...actions... msf undefinedcodeexecexceptiondelegator set ACTION msf...

Apache Struts 2 Developer Mode OGNL Execution

This module exploits a remote command execution vulnerability in Apache Struts 2. The problem exists on applications running in developer mode, where the DebuggingInterceptor allows evaluation and execution of OGNL expressions, which allows remote attackers to execute arbitrary Java code. This...

OP5 license.php Remote Command Execution

This module exploits an arbitrary root command execution vulnerability in the OP5 Monitor license.php. Ekelow has confirmed that OP5 Monitor versions 5.3.5, 5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable. Module Options msf use exploit/multi/http/op5/license msf undefinedlicense show actions...

OP5 welcome Remote Command Execution

This module exploits an arbitrary root command execution vulnerability in OP5 Monitor welcome. Ekelow AB has confirmed that OP5 Monitor versions 5.3.5, 5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable. Module Options msf use exploit/multi/http/op5/welcome msf undefinedwelcome show actions ...actions...

Windows Escalate UAC Execute RunAs

This module will attempt to elevate execution level using the ShellExecute undocumented RunAs flag to bypass low UAC settings. Module Options msf use exploit/windows/local/ask msf undefinedask show actions ...actions... msf undefinedask set ACTION msf undefinedask show options ...show and set...

Windows Manage Mount Shadow Copy

This module will attempt to mount a Volume Shadow Copy on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage Get Shadow Copy Storage Info

This module will attempt to get volume shadow copy storage info. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage Create Shadow Copy

This module will attempt to create a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage List Shadow Copies

This module will attempt to list any Volume Shadow Copies on the system. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

Windows Manage Set Shadow Copy Storage Space

This module will attempt to change the amount of space for volume shadow copy storage. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. Works on win2k3 and later...

CorpWatch Company Name Information Search

This module interfaces with the CorpWatch API to get publicly available info for a given company name. Please note that by using CorpWatch API, you acknowledge the limitations of the data CorpWatch provides, and should always verify the information with the official SEC filings before taking any...

CorpWatch Company ID Information Search

This module interfaces with the CorpWatch API to get publicly available info for a given CorpWatch ID of the company. If you don't know the CorpWatch ID, please use the corpwatchlookupname module first. This module requires Metasploit: https://metasploit.com/download Current source:...

Hashtable Collisions

This module uses a denial-of-service DoS condition appearing in a variety of programming languages. This vulnerability occurs when storing multiple values in a hash table and all values have the same hash value. This can cause a web server parsing the POST parameters issued with a request into a...

Telnet Service Encryption Key ID Overflow Detection

Detect telnet services vulnerable to the encrypt option Key ID overflow BSD-derived telnetd This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Telnet Service Encryption Key ID Overflow Detection',...

CoCSoft StreamDown 6.8.0 Buffer Overflow

Stream Down 6.8.0 seh based buffer overflow triggered when processing the server response packet. During the overflow a structured exception handler is overwritten. Module Options msf use exploit/windows/misc/stream/downbof msf undefineddownbof show actions ...actions... msf undefineddownbof set...

OpenTFTP SP 1.4 Error Packet Overflow

This module exploits a buffer overflow in OpenTFTP Server SP 1.4. The vulnerable condition triggers when the TFTP opcode is configured as an error packet, the TFTP service will then format the message using a sprintf function, which causes an overflow, therefore allowing remote code execution und...

Oracle Job Scheduler Named Pipe Command Execution

This module exploits the Oracle Job Scheduler to execute arbitrary commands. The Job Scheduler is implemented via the component extjob.exe which listens on a named pipe called "orcljsex" and execute arbitrary commands received over this channel via CreateProcess. In order to connect to the Named...

FreeBSD Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the FreeBSD telnet service. Module Options msf use exploit/freebsd/telnet/telnet/encryptkeyid msf undefinedencryptkeyid show actions ...actions... msf undefinedencryptkeyid set ACTION msf undefinedencryptkeyid show options...

Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow

This module exploits a buffer overflow in the encryption option handler of the Linux BSD-derived telnet service inetutils or krb5-telnet. Most Linux distributions use NetKit-derived telnet daemons, so this flaw only applies to a small subset of Linux systems running telnetd. Module Options msf us...

HP Managed Printing Administration jobAcct Remote Command Execution

This module exploits an arbitrary file upload vulnerability on HP Managed Printing Administration 2.6.3 and prior versions. The vulnerability exists in the UploadFiles function from the MPAUploader.Uploader.1 control, loaded and used by the server. The function can be abused via directory travers...

TFTP File Transfer Utility

This module will transfer a file to or from a remote TFTP server. Note that the target must be able to connect back to the Metasploit system, and NAT traversal for TFTP is often unsupported. Two actions are supported: "Upload" and "Download," which behave as one might expect -- use 'set action...

OKI Printer Default Login Credential Scanner

This module scans for OKI printers via SNMP, then tries to connect to found devices with vendor default administrator credentials via HTTP authentication. By default, OKI network printers use the last six digits of the MAC as admin password. This module requires Metasploit:...

7-Technologies IGSS 9 IGSSdataServer.exe DoS

The 7-Technologies SCADA IGSS Data Server IGSSdataServer.exe use auxiliary/dos/scada/igss9/dataserver msf undefineddataserver show actions ...actions... msf undefineddataserver set ACTION msf undefineddataserver show options ...show and set options... msf undefineddataserver run This module...

Enterasys NetSight nssyslogd.exe Buffer Overflow

This module exploits a stack buffer overflow in Enterasys NetSight. The vulnerability exists in the Syslog service nssylogd.exe when parsing a specially crafted PRIO from a syslog message. The module has been tested successfully on Enterasys NetSight 4.0.1.34 over Windows XP SP3 and Windows 2003...

Novell eDirectory eMBox Unauthenticated File Access

This module will access Novell eDirectory's eMBox service and can run the following actions via the SOAP interface: GETDN, READLOGS, LISTSERVICES, STOPSERVICE, STARTSERVICE, SETLOGFILE. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Gather RazorSQL Credentials

This module stores username, password, type, host, port, database and name collected from profiles.txt of RazorSQL. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'Windows...

Windows Command Shell, Bind TCP (via perl) IPv6

Listen for a connection and spawn a command shell via perl persistent This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 140 include Msf::Payload::Single include...

Unix Command Shell, Bind TCP (via perl) IPv6

Listen for a connection and spawn a command shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Sessions::CommandShellOptio...

Unix Command Shell, Bind TCP (via Ruby) IPv6

Continually listen for a connection and spawn a command shell via Ruby This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 142 include Msf::Payload::Single include...

CheckPoint Firewall-1 SecuRemote Topology Service Hostname Disclosure

This module sends a query to the port 264/TCP on CheckPoint Firewall-1 firewalls to obtain the firewall name and management station such as SmartCenter name via a pre-authentication request. The string returned is the CheckPoint Internal CA CN for SmartCenter and the firewall host. Whilst...