HTTP Cross-Site Tracing Detection

Checks if the host is vulnerable to Cross-Site Tracing XST This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Cross-Site Tracing Detection', 'Description' = 'Checks if the host is vulnerable ...

Windows Gather Domain Enumeration

This module enumerates currently the domains a host can see and the domain controllers for that domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Domain Enumeration',...

Novell ZENworks Asset Management Remote Execution

This module exploits a path traversal flaw in Novell ZENworks Asset Management 7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file outside of the MalibuUploadDirectory and then make a secondary request that allows for arbitrary code execution. Module Options msf use...

HP Data Protector 6.10/6.11/6.20 Install Service

This module exploits HP Data Protector OmniInet process on Windows only. This exploit invokes the install service function which allows an attacker to create a custom payload in the format of an executable. To ensure this works, the SMB server created in MSF must have a share called Omniback whic...

Windows Gather Credentials IMVU Game Client

This module extracts account username & password from the IMVU game client and stores it as loot. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Credentials...

Modbus Version Scanner

This module detects the Modbus service, tested on a SAIA PCD1.M2 system. Modbus is a clear text protocol used in common SCADA systems, developed originally as a serial-line RS232 async protocol, and later transformed to IP, which is called ModbusTCP. Module Options msf use...

HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01213 without the SSRT100649 hotfix. By specifying a long 'textFile' argument when calling the 'webappmon.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary...

NJStar Communicator 3.00 MiniSMTP Buffer Overflow

This module exploits a stack buffer overflow vulnerability in NJStar Communicator Version 3.00 MiniSMTP server. The MiniSMTP application can be seen in multiple NJStar products, and will continue to run in the background even if the software is already shutdown. According to the vendor's...

Windows Gather Enumerate Domain Tokens

This module enumerates domain account tokens, processes running under domain accounts, and domain users in the local Administrators, Users and Backup Operator groups. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Windows Gather Google Picasa Password Extractor

This module extracts and decrypts the login passwords stored by Google Picasa. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Google Picasa Password Extractor', 'Description' = ...

phpLDAPadmin query_engine Remote PHP Code Injection

This module exploits a vulnerability in the lib/functions.php for phpLDAPadmin versions 1.2.1.1 and earlier that allows attackers input parsed directly to the createfunction php function. A patch was issued that uses a whitelist regex expression to check the user supplied input before being parse...

Windows Manage Host File Entry Removal

This module allows the attacker to remove an entry from the Windows hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Host File Entry Removal', 'Description' = %q This...

Windows Gather Windows Host File Enumeration

This module returns a list of entries in the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Windows Host File Enumeration', 'Description' = %q This...

Windows Manage Hosts File Injection

This module allows the attacker to insert a new entry into the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Manage Hosts File Injection'...

Windows Manage Certificate Authority Removal

This module allows the attacker to remove an arbitrary CA certificate from the victim's Trusted Root store. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Certificate Authority...

Windows Manage Certificate Authority Injection

This module allows the attacker to insert an arbitrary CA certificate into the victim's Trusted Root store. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Certificate Authority...

SAP Management Console OSExecute

This module allows execution of operating system commands through the SAP Management Console SOAP Interface. A valid username and password must be provided. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

SAP Management Console Get Process Parameters

This module simply attempts to output a SAP process parameters and configuration settings through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP...

SAP Management Console Get Access Points

This module simply attempts to output a list of SAP access points through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console Get...

SAP URL Scanner

This module scans for commonly found SAP Internet Communication Manager URLs and outputs return codes for the user. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP URL Scanner', 'Descriptio...

Persistent Payload in Windows Volume Shadow Copy

This module will attempt to create a persistent payload in a new volume shadow copy. This is based on the VSSOwn Script originally posted by Tim Tomes and Mark Baggett. This module has been tested successfully on Windows 7. In order to achieve persistence through the RUNKEY option, the user shoul...

Honeywell Tema Remote Installer ActiveX Remote Code Execution

This module exploits a vulnerability found in the Honeywell Tema ActiveX Remote Installer. This ActiveX control can be abused by using the DownloadFromURL function to install an arbitrary MSI from a remote location without checking source authenticity or user notification. This module has been...

HP Power Manager 'formExportDataLogs' Buffer Overflow

This module exploits a buffer overflow in HP Power Manager's 'formExportDataLogs'. By creating a malformed request specifically for the fileName parameter, a stack-based buffer overflow occurs due to a long error message which contains the fileName, which may result in arbitrary remote code...

AdminStudio LaunchHelp.dll ActiveX Arbitrary Code Execution

This module exploits a vulnerability in AdminStudio LaunchHelp.dll ActiveX control. The LaunchProcess function found in LaunchHelp.HelpLauncher.1 allows remote attackers to run arbitrary commands on the victim machine. This module has been successfully tested with the ActiveX installed with...

Multi Gather DNS Service Record Lookup Scan

Enumerates known SRV Records for a given domain using target host DNS query tool. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather DNS Service Record Lookup Scan', 'Description' = %...

Multi Gather DNS Forward Lookup Bruteforce

Brute force subdomains and hostnames via wordlist. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather DNS Forward Lookup Bruteforce', 'Description' = %q Brute force subdomains and...

Multi Manage System Remote TCP Shell Session

This module will create a Reverse TCP Shell on the target system using the system's own scripting environments installed on the target. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi...

Windows Gather Credential Store Enumeration and Decryption Module

This module will enumerate the Microsoft Credential Store and decrypt the credentials. This module can only access credentials created by the user the process is running as. It cannot decrypt Domain Network Passwords, but will display the username and location. This module requires Metasploit:...

Cross Platform Webkit File Dropper

This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\ This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework cla...

Cisco Network Access Manager Directory Traversal Vulnerability

This module tests whether a directory traversal vulnerability is present in versions of Cisco Network Access Manager 4.8.x You may wish to change FILE e.g. passwd or hosts, MAXDIRS and RPORT depending on your environment. This module requires Metasploit: https://metasploit.com/download Current...

Oracle Password Hashdump

This module dumps the usernames and password hashes from Oracle given the proper Credentials and SID. These are then stored as creds for later cracking using auxiliary/analyze/jtroraclefast. This module supports Oracle DB versions 8i, 9i, 10g, 11g, and 12c. This module requires Metasploit:...

Java Applet Rhino Script Engine Remote Code Execution

This module exploits a vulnerability in the Rhino Script Engine that can be used by a Java Applet to run arbitrary Java code outside of the sandbox. The vulnerability affects version 7 and version 6 update 27 and earlier, and should work on any browser that supports Java for example: IE, Firefox,...

Multi Gather OpenSSH PKI Credentials Collection

This module will collect the contents of all users' .ssh directories on the targeted machine. Additionally, knownhosts and authorizedkeys and any other files are also downloaded. This module is largely based on firefoxcreds.rb. This module requires Metasploit: https://metasploit.com/download...

HTTP Page Scraper

Scrape defined data from a specific web page based on a regular expression This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Page Scraper', 'Description' = 'Scrape defined data from a specif...

Microsoft Windows Browser Pool DoS

This module exploits a denial of service flaw in the Microsoft Windows SMB service on versions of Windows Server 2003 that have been configured as a domain controller. By sending a specially crafted election request, an attacker can cause a pool overflow. The vulnerability appears to be due to an...

Java RMI Server Insecure Endpoint Code Execution Scanner

Detect Java RMI endpoints Module Options msf use auxiliary/scanner/misc/java/rmiserver msf undefinedrmiserver show actions ...actions... msf undefinedrmiserver set ACTION msf undefinedrmiserver show options ...show and set options... msf undefinedrmiserver run This module requires Metasploit:...

Java RMI Server Insecure Default Configuration Java Code Execution

This module takes advantage of the default configuration of the RMI Registry and RMI Activation services, which allow loading classes from any remote HTTP URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every RMI endpoint, it can be used against both...

Cisco Gather Device General Information

This module collects a Cisco IOS or NXOS device information and configuration...

Multi Gather DNS Reverse Lookup Scan

Performs DNS reverse lookup using the OS included DNS query command. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather DNS Reverse Lookup Scan', 'Description' = %q Performs DNS rever...

Multi Gather Ping Sweep

Performs IPv4 ping sweep using the OS included ping command. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather Ping Sweep', 'Description' = %q Performs IPv4 ping sweep using the OS...

Windows Manage Memory Payload Injection Module

This module will inject into the memory of a process a specified windows payload. If a payload or process is not provided one will be created by default using a reverse x86 TCP Meterpreter Payload...

Windows Manage Process Migration

This module will migrate a Meterpreter session from one process to another. A given process PID to migrate to or the module can spawn one and migrate to that newly spawned process. This module requires Metasploit: https://metasploit.com/download Current source:...

Apple Safari file:// Arbitrary Code Execution

This module exploits a vulnerability found in Apple Safari on OS X platform. A policy issue in the handling of file:// URLs may allow arbitrary remote code execution under the context of the user. In order to trigger arbitrary remote code execution, the best way seems to be opening a share on the...

ScriptFTP LIST Remote Buffer Overflow

AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow vulnerability that is triggered when processing a sufficiently long filename during a FTP LIST command resulting in overwriting the exception handler. Social engineering of executing a specially crafted ftp file by double click...

Windows Manage Memory Payload Injection

This module will inject a payload into memory of a process. If a payload isn't selected, then it'll default to a reverse x86 TCP meterpreter. If the PID datastore option isn't specified, then it'll inject into notepad.exe instead. Module Options msf use exploit/windows/local/payload/inject msf...

Windows Gather FTP Navigator Saved Password Extraction

This module extracts saved passwords from the FTP Navigator FTP client. It will decode the saved passwords and store them in the database. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Window...

Windows Gather Meebo Password Extractor

This module extracts login account password stored by Meebo Notifier, a desktop version of Meebo's Online Messenger. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Meebo Passwor...

Apache Reverse Proxy Bypass Vulnerability Scanner

Scan for poorly configured reverse proxy servers. By default, this module attempts to force the server to make a request with an invalid domain name. Then, if the bypass is successful, the server will look it up and of course fail, then responding with a status code 502. A baseline status code is...

Windows Gather DynDNS Client Password Extractor

This module extracts the username, password, and hosts for DynDNS version 4.1.8. This is done by downloading the config.dyndns file from the victim machine, and then automatically decode the password field. The original copy of the config file is also saved to disk. This module requires Metasploi...

Windows Gather Internet Explorer User Data Enumeration

This module will collect history, cookies, and credentials from either HTTP auth passwords, or saved form passwords found in auto-complete in Internet Explorer. The ability to gather credentials is only supported for versions of IE =7, while history and cookies can be extracted for all versions...