Java Meterpreter, Java Reverse HTTPS Stager

Run a meterpreter server in Java. Tunnel communication over HTTPS This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Stager include Msf::Payload::Java...

Measuresoft ScadaPro Remote Command Execution

This module allows remote attackers to execute arbitrary commands on the affected system by abusing via Directory Traversal attack when using the 'xf' command execute function. An attacker can execute system from msvcrt.dll to upload a backdoor and gain remote code execution. This vulnerability...

Beckhoff TwinCAT SCADA PLC 2.11.0.2004 DoS

The Beckhoff TwinCAT version use auxiliary/dos/scada/beckhoff/twincat msf undefinedtwincat show actions ...actions... msf undefinedtwincat set ACTION msf undefinedtwincat show options ...show and set options... msf undefinedtwincat run This module requires Metasploit:...

DaqFactory HMI NETB Request Overflow

This module exploits a stack buffer overflow in Azeotech's DaqFactory product. The specific vulnerability is triggered when sending a specially crafted 'NETB' request to port 20034. Exploitation of this vulnerability may take a few seconds due to the use of egghunter. This vulnerability was one o...

Windows Gather Run WMIC Commands

This module executes WMIC commands on the specified host. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Run WMIC Commands', 'Description' = %q This module executes WMIC command...

ACDSee FotoSlate PLP File id Parameter Overflow

This module exploits a buffer overflow in ACDSee FotoSlate 4.0 Build 146 via a specially crafted id parameter in a String element. When viewing a malicious PLP file with the ACDSee FotoSlate product, a remote attacker could overflow a buffer and execute arbitrary code. This exploit has been teste...

ScadaTEC ScadaPhone Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version 5.3.11.1230 of scadaTEC's ScadaPhone. In order for the command to be executed, an attacker must convince someone to load a specially crafted project zip file with ScadaPhone. By doing so, an attacker can execute arbitrary...

CyberLink Power2Go name Attribute (p2g) Stack Buffer Overflow Exploit

This module exploits a stack buffer overflow in CyberLink Power2Go version 8.x The vulnerability is triggered when opening a malformed p2g file containing an overly long string in the 'name' attribute of the file element. This results in overwriting a structured exception handler record. Module...

CTEK SkyRouter 4200 and 4300 Command Execution

This module exploits an unauthenticated remote root exploit within ctek SkyRouter 4200 and 4300. Module Options msf use exploit/unix/http/ctek/skyrouter msf undefinedskyrouter show actions ...actions... msf undefinedskyrouter set ACTION msf undefinedskyrouter show options ...show and set options...

Procyon Core Server HMI Coreservice.exe Stack Buffer Overflow

This module exploits a vulnerability in the coreservice.exe component of Proycon Core Server use exploit/windows/scada/procyon/coreserver msf undefinedcoreserver show actions ...actions... msf undefinedcoreserver set ACTION msf undefinedcoreserver show options ...show and set options... msf...

eSignal and eSignal Pro File Parsing Buffer Overflow in QUO

The software is unable to handle the "" files even those original included in the program like those with the registered extensions QUO, SUM and POR. Successful exploitation of this vulnerability may take up to several seconds due to the use of egghunter. Also, DEP bypass is unlikely due to the...

Windows Gather Product Key

This module will enumerate Microsoft product license keys. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Product Key', 'Description' = %q This module will enumerate Microsoft...

DVD X Player 5.5 .plf PlayList Buffer Overflow

This module exploits a stack-based buffer overflow on DVD X Player 5.5 Pro and Standard. By supplying a long string of data in a plf file playlist, the MediaPlayerCtrl.dll component will attempt to extract a filename out of the string, and then copy it on the stack without any proper bounds...

rsyslog Long Tag Off-By-Two DoS

This module triggers an off-by-two overflow in the rsyslog daemon. This flaw is unlikely to yield code execution but is effective at shutting down a remote log daemon. This bug was introduced in version 4.6.0 and corrected in 4.6.8/5.8.5. Compiler differences may prevent this bug from causing any...

RealVNC NULL Authentication Mode Bypass

This module exploits an Authentication bypass Vulnerability in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy listener on LPORT and proxies to the target server The AUTOVNC option requires that vncviewer be installed on the attacking machine. This module requires Metasploit:...

Windows Gather Local NBD Server

Maps remote disks and logical volumes to a local Network Block Device server. Allows for forensic tools to be executed on the remote disk directly. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework nbdserver.rb Maps...

Windows Gather Physical Drives and Logical Volumes

This module will list physical drives and logical volumes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework List physical drives and logical volumes on the remote system R. Wesley McGrew [email protected]...

Windows Gather Forensic Imaging

This module will perform byte-for-byte imaging of remote disks and volumes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Forensic byte-for-byte imaging of remote disks and volumes R. Wesley McGrew...

Free MP3 CD Ripper 1.1 WAV File Stack Buffer Overflow

This module exploits a stack based buffer overflow found in Free MP3 CD Ripper 1.1. The overflow is triggered when an unsuspecting user opens a malicious WAV file. Module Options msf use exploit/windows/fileformat/free/mp3ripperwav msf undefinedmp3ripperwav show actions ...actions... msf...

Multi Generic Operating System Session Close

This module closes the specified session. This can be useful as a finisher for automation tasks This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Generic Operating System Session Close',...

Windows Gather AutoLogin User Credential Extractor

This module extracts the plain-text Windows user login password in Registry. It exploits a Windows feature that Windows 2000 to 2008 R2 allows a user or third-party Windows Utility tools to configure User AutoLogin via plain-text password insertion in AltDefaultPassword field in the registry...

BNAT Router

This module will properly route BNAT traffic and allow for connections to be established to machines on ports which might not otherwise be accessible. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Windows Gather Directory Permissions Enumeration

This module enumerates directories and lists the permissions set on found directories. Please note: if the PATH option isn't specified, then the module will start enumerate whatever is in the target machine's %PATH% variable. This module requires Metasploit: https://metasploit.com/download Curren...

BNAT Scanner

This module is a scanner which can detect Broken NAT network address translation implementations, which could result in an inability to reach ports on remote machines. Typically, these ports will appear in nmap scans as 'filtered'/'closed'. This module requires Metasploit:...

Windows Gather IP Range Reverse Lookup

This module uses Railgun, calling the gethostbyaddr function to resolve a hostname to an IP...

Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution

Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

Java Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 7497 include Msf::Payload::Single include Msf::Payload::Java include...

Apache Range Header DoS (Apache Killer)

The byterange filter in the Apache HTTP Server 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service memory and CPU consumption via a Range header that expresses multiple overlapping ranges, exploit called "Apache Killer". Module Options msf use...

SMB Scanner Check File/Directory Utility

This module is useful when checking an entire network of SMB hosts for the presence of a known file or directory. An example would be to scan all systems for the presence of antivirus or known malware outbreak. Typically you must set RPATH, SMBUser, SMBDomain and SMBPass to operate correctly. Thi...

NetBIOS Name Service Spoofer

This module forges NetBIOS Name Service NBNS responses. It will listen for NBNS requests sent to the local subnet's broadcast address and spoof a response, redirecting the querying machine to an IP of the attacker's choosing. Combined with auxiliary/server/capture/smb or...

HP Easy Printer Care XMLSimpleAccessor Class ActiveX Control Remote Code Execution

This module allows remote attackers to place arbitrary files on a users file system by abusing via Directory Traversal attack the "saveXML" method from the "XMLSimpleAccessor" class in the HP Easy Printer HPTicketMgr.dll ActiveX Control HPTicketMgr.dll 2.7.2.0. Code execution can be achieved by...

RealNetworks Realplayer QCP Parsing Heap Overflow

This module exploits a heap overflow in Realplayer when handling a .QCP file. The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is allocated on the heap and user-supplied data from the file is copied within a memory copy loop. This allows a remote attacker to execute...

MYSQL Password Hashdump

This module extracts the usernames and encrypted password hashes from a MySQL server and stores them for later cracking. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MYSQL Password Hashdump'...

Apache "mod_userdir" User Enumeration

Apache with the UserDir directive enabled generates different error codes when a username exists and there is no publichtml directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server. This module requires Metasploit:...

Windows Gather Hardware Enumeration

Enumerate PCI hardware information from the registry. Please note this script will run through registry subkeys such as: 'PCI', 'ACPI', 'ACPIHAL', 'FDC', 'HID', 'HTREE', 'IDE', 'ISAPNP', 'LEGACY'', LPTENUM', 'PCIIDE', 'SCSI', 'STORAGE', 'SW', and 'USB'; it will take time to finish. It is...

ktsuss suid Privilege Escalation

This module attempts to gain root privileges by exploiting a vulnerability in ktsuss versions 1.4 and prior. The ktsuss executable is setuid root and does not drop privileges prior to executing user specified commands, resulting in command execution with root privileges. This module has been test...

VSploit Email PII

This auxiliary reads from a file and sends data which should be flagged via an internal or external SMTP server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSploit Email PII', 'Description...

VSploit Web PII

This module emulates a webserver leaking PII data This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSploit Web PII', 'Description' = 'This module emulates a webserver leaking PII data', 'License...

Windows Gather Credential Collector

This module harvests credentials found on the host and stores them in the database. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Credential Collector', 'Description' = %q This...

VSploit Zeus DNS Query Module

This module queries known Zeus Botnet DNS records. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSploit Zeus DNS Query Module', 'Description' = 'This module queries known Zeus Botnet DNS...

VSploit DNS Beaconing Emulation

This module takes a list and emulates malicious DNS beaconing. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSploit DNS Beaconing Emulation', 'Description' = 'This module takes a list and...

VSploit Mariposa DNS Query Module

This module queries known Mariposa Botnet DNS records. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSploit Mariposa DNS Query Module', 'Description' = 'This module queries known Mariposa...

TeeChart Professional ActiveX Control Trusted Integer Dereference

This module exploits an integer overflow in TeeChart Pro ActiveX control. When sending an overly large/negative integer value to the AddSeries property of TeeChart2010.ocx, the code will perform an arithmetic operation that wraps the value and is later directly trusted and called upon. This modul...

Windows Gather SmartFTP Saved Password Extraction

This module finds saved login credentials for the SmartFTP FTP client for windows. It finds the saved passwords and decrypts them. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class...

Windows Gather IPSwitch iMail User Data Enumeration

This module will collect iMail user data such as the username, domain, full name, e-mail, and the decoded password. Please note if IMAILUSER is specified, the module extracts user data from all the domains found. If IMAILDOMAIN is specified, then it will extract all user data under that particula...

Windows Gather Nimbuzz Instant Messenger Password Extractor

This module extracts the account passwords saved by Nimbuzz Instant Messenger in hex format. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Nimbuzz Instant Messenger Password...

Windows Gather WS_FTP Saved Password Extraction

This module extracts weakly encrypted saved FTP Passwords from WSFTP. It finds saved FTP connections in the wsftp.ini file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather WSFTP...

Windows Gather CoreFTP Saved Password Extraction

This module extracts saved passwords from the CoreFTP FTP client. These passwords are stored in the registry. They are encrypted with AES-128-ECB. This module extracts and decrypts these passwords. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Gather Trillian Password Extractor

This module extracts account password from Trillian & Trillian Astra v4.x-5.x instant messenger. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Trillian Password Extractor',...

Windows Gather Internet Download Manager (IDM) Password Extractor

This module recovers the saved premium download account passwords from Internet Download Manager IDM. These passwords are stored in an encoded format in the registry. This module traverses through these registry entries and decodes them. Thanks to the template code of theLightCosine's CoreFTP...