Iconics GENESIS32 Integer Overflow Version 9.21.201.01

The GenBroker service on port 38080 is affected by three integer overflow vulnerabilities while handling opcode 0x4b0, which is caused by abusing the the memory allocations needed for the number of elements passed by the client. This results unexpected behaviors such as direct registry calls,...

DATAC RealWin SCADA Server 2 On_FC_CONNECT_FCS_a_FILE Buffer Overflow

This module exploits a vulnerability found in DATAC Control International RealWin SCADA Server 2.1 and below. By supplying a specially crafted OnFCBINFILEFCSFILE packet via port 910, RealWin will try to create a file which would be saved to C:\Program Files\DATAC\Real Win\RW-version\filename by...

Windows Gather ARP Scanner

This Module will perform an ARP scan for a given IP range through a Meterpreter Session. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather ARP Scanner', 'Description' = %q This...

MPlayer Lite M3U Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in MPlayer Lite r33064, caused by improper bounds checking of an URL entry. By persuading the victim to open a specially-crafted .M3U file, specifically by drag-and-dropping it to the player, a remote attacker can execute arbitrary...

Saltstack Minion Payload Deployer

This exploit module uses saltstack salt to deploy a payload and run it on all targets which have been selected default all. Currently only works against nix targets. Module Options msf use exploit/linux/local/saltstack/saltminiondeployer msf undefinedsaltminiondeployer show actions ...actions...

Oracle RDBMS Login Utility

This module attempts to authenticate against an Oracle RDBMS instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. Due to a bug in nmap versions 6.50-7.80 may not work. This module requires Metasploit: https://metasploit.com/download...

Adobe Flash Player AVM Bytecode Verification Vulnerability

This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JITJust-In-Time code being executed. This is the same vulnerability that was used for the RSA attack ...

Oracle TNS Listener SID Bruteforce

This module queries the TNS listener for a valid Oracle database instance name also known as a SID. Any response other than a "reject" will be considered a success. If a specific SID is provided, that SID will be attempted. Otherwise, SIDs read from the named file will be attempted in sequence...

SAP Management Console OSExecute Payload Execution

This module executes an arbitrary payload through the SAP Management Console SOAP Interface. A valid username and password for the SAP Management Console must be provided. This module has been tested successfully on both Windows and Linux platforms running SAP Netweaver. In order to exploit a Lin...

Majordomo2 _list_file_get() Directory Traversal

This module exploits a directory traversal vulnerability present in the listfileget function of Majordomo2 help function. By default, this module will attempt to download the Majordomo config.pl file. Module Options msf use auxiliary/scanner/http/majordomo2/directorytraversal msf...

Foxit PDF Reader 4.2 Javascript File Write

This module exploits an unsafe Javascript API implemented in Foxit PDF Reader version 4.2. The createDataObject Javascript API function allows for writing arbitrary files to the file system. This issue was fixed in version 4.3.1.0218. Note: This exploit uses the All Users directory currently, whi...

LotusCMS 3.0 eval() Remote Command Execution

This module exploits a vulnerability found in Lotus CMS 3.0's Router function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call, therefore allowing remote code execution. The module can either automatically pick up a 'page' parameter from the default...

SAP Management Console Brute Force

This module simply attempts to brute force the username and password for the SAP Management Console SOAP Interface. If the SAPSID value is set it will replace instances of in any user/pass from any wordlist. This module requires Metasploit: https://metasploit.com/download Current source:...

SAP Management Console getStartProfile

This module simply attempts to access the SAP startup profile through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console...

SAP Management Console Instance Properties

This module simply attempts to identify the instance properties through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console Instanc...

SAP Service Discovery

Scans for listening SAP services. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Service Discovery', 'Description' = %q Scans for listening SAP services. , 'References' = General 'URL',...

SAP Management Console getEnvironment

This module simply attempts to identify SAP Environment settings through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console...

SAP Management Console Version Detection

This module simply attempts to identify the version of SAP through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console Version...

SAP Management Console Get Logfile

This module simply attempts to download available logfiles and developer tracefiles through the SAP Management Console SOAP Interface. Please use the sapmgmtconlistlogfiles extension to view a list of available files. This module requires Metasploit: https://metasploit.com/download Current source...

SAP Management Console ABAP Syslog Disclosure

This module simply attempts to extract the ABAP syslog through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console ABAP Syslog...

SAP Management Console List Logfiles

This module simply attempts to output a list of available logfiles and developer tracefiles through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SA...

SAP Management Console Extract Users

This module simply attempts to extract SAP users from the ABAP Syslog through the SAP Management Console SOAP Interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Management Console...

Wireshark CLDAP Dissector DOS

This module causes infinite recursion to occur within the CLDAP dissector by sending a specially crafted UDP packet. Module Options msf use auxiliary/dos/wireshark/cldap msf undefinedcldap show actions ...actions... msf undefinedcldap set ACTION msf undefinedcldap show options ...show and set...

Windows Escalate Locked Desktop Unlocker

This module unlocks a locked Windows desktop by patching the respective code inside the LSASS.exe process. This patching process can result in the target system hanging or even rebooting, so be careful when using this module on production systems. This module requires Metasploit:...

Windows Capture Keystroke Recorder

This module can be used to capture keystrokes. To capture keystrokes when the session is running as SYSTEM, the MIGRATE option must be enabled and the CAPTURETYPE option should be set to one of Explorer, Winlogon, or a specific PID. To capture the keystrokes of the interactive user, the Explorer...

Solar FTP Server Malformed USER Denial of Service

This module will send a format string as USER to Solar FTP, causing a READ violation in function "output1" found in "sfsservice.exe" while trying to calculate the length of the string. This vulnerability affects versions 2.1.1 and earlier. Module Options msf use...

Sun Java Applet2ClassLoader Remote Code Execution

This module exploits a vulnerability in the Java Runtime Environment that allows an attacker to run an applet outside of the Java Sandbox. When an applet is invoked with: 1. A "codebase" parameter that points at a trusted directory 2. A "code" parameter that is a URL that does not contain any dot...

GlobalSCAPE CuteZIP Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version 2.1 of CuteZIP. In order for the command to be executed, an attacker must convince the target user to open a specially crafted zip file with CuteZIP. By doing so, an attacker can execute arbitrary code as the target user...

xRadio 0.95b Buffer Overflow

This module exploits a buffer overflow in xRadio 0.95b. Using the application to import a specially crafted xrl file, a buffer overflow occurs allowing arbitrary code execution. Module Options msf use exploit/windows/fileformat/xradio/xrlsehbof msf undefinedxrlsehbof show actions ...actions... ms...

HP Data Protector 6 EXEC_CMD Remote Code Execution

This exploit abuses a vulnerability in the HP Data Protector service. This flaw allows an unauthenticated attacker to take advantage of the EXECCMD command and traverse back to /bin/sh, this allows arbitrary remote code execution under the context of root. Module Options msf use...

HP Data Protector 6.1 EXEC_CMD Command Execution

This module exploits HP Data Protector's omniinet process, specifically against a Windows setup. When an EXECCMD packet is sent, omniinet.exe will attempt to look for that user-supplied filename with kernel32!FindFirstFileW. If the file is found, the process will then go ahead execute it with...

EMC Replication Manager Command Execution

This module exploits a remote command-injection vulnerability in EMC Replication Manager client irccd.exe. By sending a specially crafted message invoking RunProgram function an attacker may be able to execute arbitrary commands with SYSTEM privileges. Affected products are EMC Replication Manage...

Accellion FTA MPIPE2 Command Execution

This module exploits a chain of vulnerabilities in the Accellion File Transfer appliance. This appliance exposes a UDP service on port 8812 that acts as a gateway to the internal communication bus. This service uses Blowfish encryption for authentication, but the appliance ships with two easy to...

QuickShare File Server 1.2.1 Directory Traversal Vulnerability

This module exploits a vulnerability found in QuickShare File Server's FTP service. By supplying "../" in the file path, it is possible to trigger a directory traversal flaw, allowing the attacker to read a file outside the virtual directory. By default, the "Writable" option is enabled during...

VSFTPD 2.3.2 and Earlier STAT Denial of Service

This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3 tested on 2.3.0, 2.3.1, and 2.3.2. Version 2.3.3 and higher should not be vulnerable. Module Options msf use auxiliary/dos/ftp/vsftpd/232 msf undefined232 show actions ...actions... msf undefined232 s...

Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability

This module exploits a code execution vulnerability in Mozilla Firefox 3.6.x use exploit/windows/browser/mozilla/nstreerange msf undefinednstreerange show actions ...actions... msf undefinednstreerange set ACTION msf undefinednstreerange show options ...show and set options... msf...

AOL Desktop 9.6 RTX Buffer Overflow

This module exploits a vulnerability found in AOL Desktop 9.6's Tool\rich.rct component. By supplying a long string of data in the hyperlink tag, rich.rct copies this data into a buffer using a strcpy function, which causes an overflow, and results arbitrary code execution. Module Options msf use...

VideoLAN VLC MKV Memory Corruption

This module exploits an input validation error in VideoLAN VLC use exploit/windows/fileformat/vlc/webm msf undefinedwebm show actions ...actions... msf undefinedwebm set ACTION msf undefinedwebm show options ...show and set options... msf undefinedwebm run This module requires Metasploit:...

HP OpenView Performance Insight Server Backdoor Account Code Execution

This module exploits a hidden account in the com.trinagy.security.XMLUserManager Java class. When using this account, an attacker can abuse the com.trinagy.servlet.HelpManagerServlet class and write arbitrary files to the system allowing the execution of arbitrary code. NOTE: This module has only...

Real Networks Netzip Classic 7.5.1 86 File Parsing Buffer Overflow Vulnerability

This module exploits a stack-based buffer overflow vulnerability in version 7.5.1 86 of Real Networks Netzip Classic. In order for the command to be executed, an attacker must convince someone to load a specially crafted zip file with NetZip Classic. By doing so, an attacker can execute arbitrary...

Microsoft SQL Server Payload Execution via SQL Injection

This module will execute an arbitrary payload on a Microsoft SQL Server, using a SQL injection vulnerability. Once a vulnerability is identified this module will use xpcmdshell to upload and execute Metasploit payloads. It is necessary to specify the exact point where the SQL injection...

Windows Manage Local User Account Deletion

This module deletes a local user account from the specified server, or the local machine if no server is given. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Local User Account...

SMB Domain User Enumeration

Determine what domain users are logged into a remote system via a DCERPC to NetWkstaUserEnum. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Domain User Enumeration', 'Description' =...

MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection

A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine MSDE without the updates supplied in MS09-00...

Windows Gather Local User Account SID Lookup

This module prints information about a given SID from the perspective of this session. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Local User Account SID Lookup', 'Descriptio...

GoldenFTP PASS Stack Buffer Overflow

This module exploits a vulnerability in the Golden FTP service, using the PASS command to cause a buffer overflow. Please note that in order trigger the vulnerable code, the victim machine must have the "Show new connections" setting enabled. By default, this option is unchecked. Module Options m...

Apache HTTPD mod_negotiation Filename Bruter

This module performs a brute force attack in order to discover existing files on a server which uses modnegotiation. If the filename is found, the IP address and the files found will be displayed. This module requires Metasploit: https://metasploit.com/download Current source:...

Apache HTTPD mod_negotiation Scanner

This module scans the webserver of the given hosts for the existence of modnegotiate. If the webserver has modnegotiation enabled, the IP address will be displayed. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework clas...

Citrix Provisioning Services 5.6 streamprocess.exe Buffer Overflow

This module exploits a stack buffer overflow in Citrix Provisioning Services 5.6. By sending a specially crafted packet to the Provisioning Services server, a fixed length buffer on the stack can be overflowed and arbitrary code can be executed. Module Options msf use...

Android Content Provider File Disclosure

This module exploits a cross-domain issue within the Android web browser to exfiltrate files from a vulnerable device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Content Provider...