Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMSCDCSUBSCRIBE.ACTIVATESUBSCRIPTION package/function. This vulnerability affects to Oracle Database Server 9i up to 9.2.0.5 and 10g up to 10.1.0.4. This module requires Metasploit:...

MS11-093 Microsoft Windows OLE Object File Handling Remote Code Execution

This module exploits a type confusion vulnerability in the OLE32 component of Windows XP SP3. The vulnerability exists in the CPropertyStorage::ReadMultiple function. A Visio document with a specially crafted Summary Information Stream embedded allows to get remote code execution through Internet...

IpSwitch WhatsUp Gold TFTP Directory Traversal

This modules exploits a directory traversal vulnerability in IpSwitch WhatsUp Gold's TFTP service. Module Options msf use auxiliary/scanner/tftp/ipswitch/whatsupgoldtftp msf undefinedwhatsupgoldtftp show actions ...actions... msf undefinedwhatsupgoldtftp set ACTION msf undefinedwhatsupgoldtftp sh...

Traq admincp/common.php Remote Code Execution

This module exploits an arbitrary command execution vulnerability in Traq 2.0 to 2.3. It's in the admincp/common.php script. This function is called in each script located in the /admicp/ directory to make sure the user has admin rights. This is a broken authorization schema because the header...

Splunk Search Remote Code Execution

This module abuses a command execution vulnerability in the web based interface of Splunk 4.2 to 4.2.4. The vulnerability exists in the 'mappy' search command which allows attackers to run Python code. To exploit this vulnerability, a valid Splunk user with the admin role is required. By default,...

Ability Server 2.34 STOR Command Stack Buffer Overflow

This module exploits a stack-based buffer overflow in Ability Server 2.34. Ability Server fails to check input size when parsing 'STOR' and 'APPE' commands, which leads to a stack based buffer overflow. This plugin uses the 'STOR' command. The vulnerability has been confirmed on version 2.34 and...

Solarwinds Storage Manager 5.1.0 SQL Injection

This module exploits a SQL injection found in Solarwinds Storage Manager login interface. It will send a malicious SQL query to create a JSP file under the web root directory, and then let it download and execute our malicious executable under the context of SYSTEM. Module Options msf use...

TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow

This module exploits a vulnerability in the CmdProcessor.exe component of Trend Micro Control Manger up to version 5.5. The specific flaw exists within CmdProcessor.exe service running on TCP port 20101. The vulnerable function is the CGenericScheduler::AddTask function of...

DNS and DNSSEC Fuzzer

This module will connect to a DNS server and perform DNS and DNSSEC protocol-level fuzzing. Note that this module may inadvertently crash the target server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

Adobe Reader U3D Memory Corruption Vulnerability

This module exploits a vulnerability in the U3D handling within versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader. The vulnerability is due to the use of uninitialized memory. Arbitrary code execution is achieved by embedding specially crafted U3D data into a PDF document. A hea...

Firefox nsSVGValue Out-of-Bounds Access Vulnerability

This module exploits an out-of-bounds access flaw in Firefox 7 and 8 use exploit/windows/browser/mozilla/nssvgvalue msf undefinednssvgvalue show actions ...actions... msf undefinednssvgvalue set ACTION msf undefinednssvgvalue show options ...show and set options... msf undefinednssvgvalue run Thi...

Firefox 8/9 AttributeChildRemoved() Use-After-Free

This module exploits a use-after-free vulnerability in Firefox 8/8.0.1 and 9/9.0.1. Removal of child nodes from the nsDOMAttribute can allow for a child to still be accessible after removal due to a premature notification of AttributeChildRemoved. Since mFirstChild is not set to NULL until after...

Linux Command Shell, Reverse TCP Inline

Connect to target and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 208 include Msf::Payload::Single include Msf::Payload::Linux::Armle::Prepends include...

Shodan Search

This module uses the Shodan API to search Shodan. Accounts are free and an API key is required to use this module. Output from the module is displayed to the screen and can be saved to a file or the MSF database. NOTE: SHODAN filters i.e. port, hostname, os, geo, city can be used in queries, but...

Windows Gather Privileges Enumeration

This module will print if UAC is enabled, and if the current account is ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status and current process PRIVILEGES. This module requires Metasploit: https://metasploit.com/download Current source:...

QEMU Monitor HMP 'migrate' Command Execution

This module uses QEMU's Monitor Human Monitor Interface HMP TCP server to execute system commands using the migrate command. This module has been tested successfully on QEMU version 6.2.0 on Ubuntu 20.04. Module Options msf use exploit/multi/misc/qemu/monitorhmpmigratecmdexec msf...

SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow

This module exploits a remote stack buffer overflow vulnerability in 3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9. This vulnerability affects versions 3.4 SP4 Patch 2 and earlier. Module Options msf use exploit/windows/scada/codesys/webserver msf undefinedwebserver...

H.323 Version Scanner

Detect H.323 Version. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'H.323 Version Scanner', 'Description' = 'Detect H.323 Version.', 'Author' = 'hdm', 'License' = MSFLICENSE registeroptions...

Serv-U FTP Server Buffer Overflow

This module exploits a stack buffer overflow in the site chmod command in versions of Serv-U FTP Server prior to 4.2. You must have valid credentials to trigger this vulnerability. Exploitation also leaves the service in a non-functional state. This module requires Metasploit:...

MS11-080 AfdJoinLeaf Privilege Escalation

This module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This module will elevate itself to SYSTEM, then...

WikkaWiki 1.3.2 Spam Logging PHP Injection

This module exploits a vulnerability found in WikkaWiki. When the spam logging feature is enabled, it is possible to inject PHP code into the spam log file via the UserAgent header, and then request it to execute our payload. There are at least three different ways to trigger spam protection, thi...

CCMPlayer 1.5 m3u Playlist Stack Based Buffer Overflow

This module exploits a stack based buffer overflow in CCMPlayer 1.5. Opening a m3u playlist with a long track name, a SEH exception record can be overwritten with parts of the controllable buffer. SEH execution is triggered after an invalid read of an injectable address, thus allowing arbitrary...

Family Connections less.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in Family Connections 2.7.1. It's in the dev/less.php script and is due to an insecure use of system. Authentication isn't required to exploit the vulnerability but registerglobals must be set to On. Module Options msf use...

Avid Media Composer 5.5 - Avid Phonetic Indexer Buffer Overflow

This module exploits a stack buffer overflow in process AvidPhoneticIndexer.exe port 4659, which comes as part of the Avid Media Composer 5.5 Editing Suite. This daemon sometimes starts on a different port; if you start it standalone it will run on port 4660. Module Options msf use...

John the Ripper Oracle Password Cracker (Fast Mode)

This module uses John the Ripper to identify weak passwords that have been acquired from the oraclehashdump module. Passwords that have been successfully cracked are then saved as proper credentials...

V-CMS PHP File Upload and Execute

This module exploits a vulnerability found on V-CMS's inline image upload feature. The problem is due to the inlineimageupload.php file not checking the file type before saving it on the web server. This allows any malicious user to upload a script such as PHP without authentication, and then...

Microsoft IIS FTP Server LIST Stack Exhaustion

This module triggers Denial of Service condition in the Microsoft Internet Information Services IIS FTP Server 5.0 through 7.0 via a list ls -R command containing a wildcard. For this exploit to work in most cases, you need 1 a valid ftp account: either read-only or write-access account 2 the "FT...

Multi Gather Mozilla Thunderbird Signon Credential Collection

This module will collect credentials from Mozilla Thunderbird by downloading the necessary files such as 'signons.sqlite', 'key3.db', and 'cert8.db' for offline decryption with third party tools. If necessary, you may also set the PARSE option to true to parse the sqlite file, which contains...

Yaws Web Server Directory Traversal

This module exploits a directory traversal bug in Yaws v1.9.1 or less. The module can only be used to retrieve files. However, code execution might be possible. Because when the malicious user sends a PUT request, a file is actually created, except no content is written. Module Options msf use...

Hastymail 2.1.1 RC1 Command Injection

This module exploits a command injection vulnerability found in Hastymail 2.1.1 RC1 due to the insecure usage of the calluserfuncarray function on the "lib/ajaxfunctions.php" script. Authentication is required on Hastymail in order to exploit the vulnerability. The module has been successfully...

VMware Update Manager 4 Directory Traversal

This modules exploits a directory traversal vulnerability in VMware Update Manager on port 9084. Versions affected by this vulnerability: vCenter Update Manager 4.1 prior to Update 2, vCenter Update Manager 4 Update 4. Module Options msf use auxiliary/scanner/vmware/vmware/updatemanagertraversal...

Viscom Software Movie Player Pro SDK ActiveX 6.8

Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the DrawText method. The victim will first be...

UDP Service Prober

Detect common UDP services using sequential probes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'UDP Service Prober', 'Description' = 'Detect common UDP services using...

ARP Spoof

Spoof ARP replies and poison remote ARP caches to conduct IP address spoofing or a denial of service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ARP Spoof', 'Description' = %q Spoof ARP...

Postgres Password Hashdump

This module extracts the usernames and encrypted password hashes from a Postgres server and stores them for later cracking. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postgres Password...

Windows Gather mRemote Saved Password Extraction

This module extracts saved passwords from mRemote. mRemote stores connections for RDP, VNC, SSH, Telnet, rlogin and other protocols. It saves the passwords in an encrypted format. The module will extract the connection info and decrypt the saved passwords. This module requires Metasploit:...

Multiple Linux / Unix Post Sudo Upgrade Shell

This module attempts to upgrade a shell account to UID 0 by reusing the given password and passing it to sudo. This technique relies on sudo versions from 2008 and later which support -A. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Recon Computer Browser Discovery

This module uses railgun to discover hostnames and IPs on the network. LTYPE should be set to one of the following values: WK all workstations, SVR all servers, SQL all SQL servers, DC all Domain Controllers, DCBKUP all Domain Backup Servers, NOVELL all Novell servers, PRINTSVR all Print Que...

Viscom Image Viewer CP Pro 8.0/Gold 6.0 ActiveX Control

This module exploits a stack based buffer overflow in the Active control file ImageViewer2.OCX by passing an overly long argument to an insecure TifMergeMultiFiles method. Exploitation results in code execution with the privileges of the user who browsed to the exploit page. The victim will first...

Windows Gather Wireless Current Connection Info

This module gathers information about the current connection on each wireless lan interface on the target machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Wireless Curren...

Windows Gather Wireless BSS Info

This module gathers information about the wireless Basic Service Sets available to the victim machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Wireless BSS Info',...

Windows Gather Wireless Profile

This module extracts saved Wireless LAN profiles. It will also try to decrypt the network key material. Behavior is slightly different between OS versions when it comes to WPA. In Windows Vista/7 we will get the passphrase. In Windows XP we will get the PBKDF2 derived key. This module requires...

Windows Disconnect Wireless Connection

This module disconnects the current wireless network connection on the specified interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Disconnect Wireless Connection', 'Description...

Windows Escalation

This module uses the getsystem command to escalate the current session to the SYSTEM account using various techniques. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Windows...

HP StorageWorks P4000 Virtual SAN Appliance Command Execution

This module exploits a vulnerability found in HP's StorageWorks P4000 VSA on versions prior to 9.5. By using a default account credential, it is possible to inject arbitrary commands as part of a ping request via port 13838. Module Options msf use exploit/multi/misc/hp/vsaexec msf undefinedvsaexe...

Asterisk Manager Login Utility

This module attempts to authenticate to an Asterisk Manager service. Please note that by default, Asterisk Call Management port 5038 only listens locally, but this can be manually configured in file /etc/asterisk/manager.conf by the admin on the victim machine. This module requires Metasploit:...

Windows Gather Forensics Duqu Registry Check

This module searches for CVE-2011-3402 Duqu related registry artifacts. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Forensics Duqu Registry Check', 'Description' = %q This...

Windows Gather Enumerate Computers

This module will enumerate computers included in the primary Active Directory domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Enumerate Computers', 'Description' = %q Thi...

Support Incident Tracker Remote Command Execution

This module combines two separate issues within Support Incident Tracker use exploit/multi/http/sit/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options ...show and set options... msf undefinedfileupload run This...

Aviosoft Digital TV Player Professional 1.0 Stack Buffer Overflow

This module exploits a vulnerability found in Aviosoft Digital TV Player Pro version 1.x. An overflow occurs when the process copies the content of a playlist file on to the stack, which may result arbitrary code execution under the context of the user. Module Options msf use...