Viscom Software Movie Player Pro SDK ActiveX 6.8

Stack-based buffer overflow in the MOVIEPLAYER.MoviePlayerCtrl.1 ActiveX control in MoviePlayer.ocx 6.8.0.0 in Viscom Software Movie Player Pro SDK ActiveX 6.8 allows remote attackers to execute arbitrary code via a long strFontName parameter to the DrawText method. The victim will first be...

UDP Service Prober

Detect common UDP services using sequential probes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'UDP Service Prober', 'Description' = 'Detect common UDP services using...

ARP Spoof

Spoof ARP replies and poison remote ARP caches to conduct IP address spoofing or a denial of service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ARP Spoof', 'Description' = %q Spoof ARP...

Postgres Password Hashdump

This module extracts the usernames and encrypted password hashes from a Postgres server and stores them for later cracking. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Postgres Password...

Windows Gather mRemote Saved Password Extraction

This module extracts saved passwords from mRemote. mRemote stores connections for RDP, VNC, SSH, Telnet, rlogin and other protocols. It saves the passwords in an encrypted format. The module will extract the connection info and decrypt the saved passwords. This module requires Metasploit:...

Multiple Linux / Unix Post Sudo Upgrade Shell

This module attempts to upgrade a shell account to UID 0 by reusing the given password and passing it to sudo. This technique relies on sudo versions from 2008 and later which support -A. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Recon Computer Browser Discovery

This module uses railgun to discover hostnames and IPs on the network. LTYPE should be set to one of the following values: WK all workstations, SVR all servers, SQL all SQL servers, DC all Domain Controllers, DCBKUP all Domain Backup Servers, NOVELL all Novell servers, PRINTSVR all Print Que...

Viscom Image Viewer CP Pro 8.0/Gold 6.0 ActiveX Control

This module exploits a stack based buffer overflow in the Active control file ImageViewer2.OCX by passing an overly long argument to an insecure TifMergeMultiFiles method. Exploitation results in code execution with the privileges of the user who browsed to the exploit page. The victim will first...

Windows Gather Wireless Current Connection Info

This module gathers information about the current connection on each wireless lan interface on the target machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Wireless Curren...

Windows Gather Wireless BSS Info

This module gathers information about the wireless Basic Service Sets available to the victim machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Wireless BSS Info',...

Windows Gather Wireless Profile

This module extracts saved Wireless LAN profiles. It will also try to decrypt the network key material. Behavior is slightly different between OS versions when it comes to WPA. In Windows Vista/7 we will get the passphrase. In Windows XP we will get the PBKDF2 derived key. This module requires...

Windows Disconnect Wireless Connection

This module disconnects the current wireless network connection on the specified interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Disconnect Wireless Connection', 'Description...

Windows Escalation

This module uses the getsystem command to escalate the current session to the SYSTEM account using various techniques. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Windows...

HP StorageWorks P4000 Virtual SAN Appliance Command Execution

This module exploits a vulnerability found in HP's StorageWorks P4000 VSA on versions prior to 9.5. By using a default account credential, it is possible to inject arbitrary commands as part of a ping request via port 13838. Module Options msf use exploit/multi/misc/hp/vsaexec msf undefinedvsaexe...

Asterisk Manager Login Utility

This module attempts to authenticate to an Asterisk Manager service. Please note that by default, Asterisk Call Management port 5038 only listens locally, but this can be manually configured in file /etc/asterisk/manager.conf by the admin on the victim machine. This module requires Metasploit:...

Windows Gather Forensics Duqu Registry Check

This module searches for CVE-2011-3402 Duqu related registry artifacts. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Forensics Duqu Registry Check', 'Description' = %q This...

Windows Gather Enumerate Computers

This module will enumerate computers included in the primary Active Directory domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Enumerate Computers', 'Description' = %q Thi...

Support Incident Tracker Remote Command Execution

This module combines two separate issues within Support Incident Tracker use exploit/multi/http/sit/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options ...show and set options... msf undefinedfileupload run This...

Aviosoft Digital TV Player Professional 1.0 Stack Buffer Overflow

This module exploits a vulnerability found in Aviosoft Digital TV Player Pro version 1.x. An overflow occurs when the process copies the content of a playlist file on to the stack, which may result arbitrary code execution under the context of the user. Module Options msf use...

PmWiki pagelist.php Remote PHP Code Injection Exploit

This module exploits an arbitrary command execution vulnerability in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is inside /scripts/pagelist.php. Module Options msf use exploit/multi/http/pmwiki/pagelist msf undefinedpagelist show actions ...actions... msf undefinedpagelist set ACTION ms...

AbsoluteFTP 1.9.6 - 2.2.10 LIST Command Remote Buffer Overflow

This module exploits VanDyke Software AbsoluteFTP by overflowing a filename buffer related to the LIST command. Module Options msf use exploit/windows/ftp/absolute/ftplistbof msf undefinedftplistbof show actions ...actions... msf undefinedftplistbof set ACTION msf undefinedftplistbof show options...

Squiz Matrix User Enumeration Scanner

This module attempts to enumerate remote users that exist within the Squiz Matrix and MySource Matrix CMS by sending GET requests for asset IDs e.g. ?a=14 and searching for a valid username eg "root" or "test" which is prefixed by a "" in the response. It will also try to GET the users full name ...

TYPO3 Winstaller Default Encryption Keys

This module exploits known default encryption keys found in the TYPO3 Winstaller. This flaw allows for file disclosure in the jumpUrl mechanism. This issue can be used to read any file that the web server user account has access to view. The method used to create the juhash short MD5 hash was...

TYPO3 sa-2009-001 Weak Encryption Key File Disclosure

This module exploits a flaw in TYPO3 encryption ey creation process to allow for file disclosure in the jumpUrl mechanism. This flaw can be used to read any file that the web server user account has access to view. This module requires Metasploit: https://metasploit.com/download Current source:...

TYPO3 sa-2010-020 Remote File Disclosure

This module exploits a flaw in the way the TYPO3 jumpurl feature matches hashes. Due to this flaw a Remote File Disclosure is possible by matching the juhash of 0. This flaw can be used to read any file that the web server user account has access to view. This module requires Metasploit:...

Windows Gather McAfee ePO 4.6 Config SQL Credentials

This module extracts connection details and decrypts the saved password for the SQL database in use by a McAfee ePO 4.6 server. The passwords are stored in a config file. They are encrypted with AES-128-ECB and a static key. This module requires Metasploit: https://metasploit.com/download Current...

Windows Gather Terminal Server Client Connection Information Dumper

This module dumps MRU and connection data for RDP sessions This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Terminal Server Client Connection Information Dumper', 'Description' = ...

Mini-Stream 3.0.1.1 Buffer Overflow

This module exploits a stack buffer overflow in Mini-Stream 3.0.1.1 By creating a specially crafted pls file, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

InduSoft Web Studio Arbitrary Upload Remote Code Execution

This module exploits a lack of authentication and authorization on the InduSoft Web Studio Remote Agent, that allows a remote attacker to write arbitrary files to the filesystem, by abusing the functions provided by the software. The module uses the Windows Management Instrumentation service to...

Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020006 Buffer Overflow

This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 without Hotfix CPVS56SP1E043 by sending a malformed packet with the opcode 0x40020006 GetObjetsRequest to the 6905/UDP port. The module, which allows code execution under the context of SYSTEM, has been...

Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020000 Buffer Overflow

This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 without Hotfix CPVS56SP1E043 by sending a malformed packet to the 6905/UDP port. The module has been successfully tested on Windows Server 2003 SP2, Windows 7, and Windows XP SP3. Module Options msf use...

Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020004 Buffer Overflow

This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 without Hotfix CPVS56SP1E043 by sending a malformed packet with the opcode 0x40020004 GetBootRecordRequest to the 6905/UDP port. The module, which allows code execution under the context of SYSTEM, has been...

Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020002 Buffer Overflow

This module exploits a remote buffer overflow in the Citrix Provisioning Services 5.6 SP1 without Hotfix CPVS56SP1E043 by sending a malformed packet with the opcode 0x40020002 GetFooterRequest to the 6905/UDP port. The module, which allows code execution under the context of SYSTEM, has been...

HTTP Cross-Site Tracing Detection

Checks if the host is vulnerable to Cross-Site Tracing XST This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Cross-Site Tracing Detection', 'Description' = 'Checks if the host is vulnerable ...

Windows Gather Domain Enumeration

This module enumerates currently the domains a host can see and the domain controllers for that domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Domain Enumeration',...

Novell ZENworks Asset Management Remote Execution

This module exploits a path traversal flaw in Novell ZENworks Asset Management 7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file outside of the MalibuUploadDirectory and then make a secondary request that allows for arbitrary code execution. Module Options msf use...

HP Data Protector 6.10/6.11/6.20 Install Service

This module exploits HP Data Protector OmniInet process on Windows only. This exploit invokes the install service function which allows an attacker to create a custom payload in the format of an executable. To ensure this works, the SMB server created in MSF must have a share called Omniback whic...

Windows Gather Credentials IMVU Game Client

This module extracts account username & password from the IMVU game client and stores it as loot. -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Credentials...

Modbus Version Scanner

This module detects the Modbus service, tested on a SAIA PCD1.M2 system. Modbus is a clear text protocol used in common SCADA systems, developed originally as a serial-line RS232 async protocol, and later transformed to IP, which is called ModbusTCP. Module Options msf use...

HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01213 without the SSRT100649 hotfix. By specifying a long 'textFile' argument when calling the 'webappmon.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary...

NJStar Communicator 3.00 MiniSMTP Buffer Overflow

This module exploits a stack buffer overflow vulnerability in NJStar Communicator Version 3.00 MiniSMTP server. The MiniSMTP application can be seen in multiple NJStar products, and will continue to run in the background even if the software is already shutdown. According to the vendor's...

Windows Gather Enumerate Domain Tokens

This module enumerates domain account tokens, processes running under domain accounts, and domain users in the local Administrators, Users and Backup Operator groups. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection

This module exploits an arbitrary PHP code execution flaw in the phpScheduleIt software. This vulnerability is only exploitable when the magicquotesgpc PHP option is 'off'. Authentication is not required to exploit the bug. Version 1.2.10 and earlier of phpScheduleIt are affected. This module...

Windows Gather Google Picasa Password Extractor

This module extracts and decrypts the login passwords stored by Google Picasa. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Google Picasa Password Extractor', 'Description' = ...

phpLDAPadmin query_engine Remote PHP Code Injection

This module exploits a vulnerability in the lib/functions.php for phpLDAPadmin versions 1.2.1.1 and earlier that allows attackers input parsed directly to the createfunction php function. A patch was issued that uses a whitelist regex expression to check the user supplied input before being parse...

Windows Manage Certificate Authority Removal

This module allows the attacker to remove an arbitrary CA certificate from the victim's Trusted Root store. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Certificate Authority...

Windows Manage Host File Entry Removal

This module allows the attacker to remove an entry from the Windows hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Host File Entry Removal', 'Description' = %q This...

Windows Gather Windows Host File Enumeration

This module returns a list of entries in the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Windows Host File Enumeration', 'Description' = %q This...

Windows Manage Hosts File Injection

This module allows the attacker to insert a new entry into the target system's hosts file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'English' class MetasploitModule 'Windows Manage Hosts File Injection'...

Windows Manage Certificate Authority Injection

This module allows the attacker to insert an arbitrary CA certificate into the victim's Trusted Root store. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Certificate Authority...