CA BrightStor ARCserve Message Engine 0x72 Buffer Overflow

This module exploits a buffer overflow in Computer Associates BrightStor ARCserve Backup 11.1 - 11.5 SP2. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/message/engine72 msf...

Novell iManager getMultiPartParameters Arbitrary File Upload

This module exploits a directory traversal vulnerability which allows remote attackers to upload and execute arbitrary code. PortalModuleInstallManager Module Options msf use exploit/windows/http/novell/imanagerupload msf undefinedimanagerupload show actions ...actions... msf...

Windows MessageBox

Spawns a dialog via MessageBox using a customizable title, text & icon This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 231 include Msf::Payload::Windows include Msf::Payload::Singl...

SMB File Upload Utility

This module uploads a file to a target share and path. The only reason to use this module is if your existing SMB client is not able to support the features of the Metasploit Framework that you need, like pass-the-hash authentication. This module requires Metasploit: https://metasploit.com/downlo...

FrontPage Server Extensions Anonymous Login Scanner

This module queries the FrontPage Server Extensions and determines whether anonymous access is allowed. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FrontPage Server Extensions Anonymous Log...

Lotus Domino Password Hash Collector

Get users passwords hashes from names.nsf page This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lotus Domino Password Hash Collector', 'Description' = 'Get users passwords hashes from names.nsf...

Microsoft Internet Explorer Unsafe Scripting Misconfiguration

This exploit takes advantage of the "Initialize and script ActiveX controls not marked safe for scripting" setting within Internet Explorer. When this option is set, IE allows access to the WScript.Shell ActiveX control, which allows javascript to interact with the file system and run commands...

Digital Music Pad Version 8.2.3.3.4 Stack Buffer Overflow

This module exploits a buffer overflow in Digital Music Pad Version 8.2.3.3.4 When opening a malicious pls file with the Digital Music Pad, a remote attacker could overflow a buffer and execute arbitrary code. Module Options msf use exploit/windows/fileformat/digital/musicpadpls msf...

Socks4a Proxy Server

This module provides a socks4a proxy server that uses the builtin Metasploit routing to relay connections...

BACnet OPC Client Buffer Overflow

This module exploits a stack buffer overflow in SCADA Engine BACnet OPC Client v1.0.24. When the BACnet OPC Client parses a specially crafted csv file, arbitrary code may be executed. Module Options msf use exploit/windows/fileformat/bacnet/csv msf undefinedcsv show actions ...actions... msf...

IBM Lotus Domino iCalendar MAILTO Buffer Overflow

This module exploits a vulnerability found in IBM Lotus Domino iCalendar. By sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe" crashes due to a Cstrcpy routine in nnotes.dll, which allows remote attackers to gain arbitrary code execution. Note: In order to...

Microsoft IIS 6.0 ASP Stack Exhaustion Denial of Service

The vulnerability allows remote unauthenticated attackers to force the IIS server to become unresponsive until the IIS service is restarted manually by the administrator. Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a Post Form value. Module Options...

MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability

This module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is...

Windows Escalate Task Scheduler XML Privilege Escalation

This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet. When processing task files, the Windows Task Scheduler only uses a CRC32 checksum to validate that the file has not been tampered with. Also, In a default configuration, normal users can read and write the task files that...

HP Data Protector DtbClsLogin Buffer Overflow

This module exploits a stack buffer overflow in HP Data Protector 4.0 SP1. The overflow occurs during the login process, in the DtbClsLogin function provided by the dpwindtb.dll component, where the Utf8Cpy strcpy like function is used in an insecure way with the username. A successful exploitati...

Audiotran PLS File Stack Buffer Overflow

This module exploits a stack-based buffer overflow in Audiotran 1.4.2.4. An attacker must send the file to victim and the victim must open the file. Alternatively, it may be possible to execute code remotely via an embedded PLS file within a browser when the PLS extension is registered to...

Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow

This module exploits a vulnerability in the Smart INdependent Glyplets SING table handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior versions are assumed to be vulnerable as well. Module Options msf use exploit/windows/fileformat/adobe/cooltypesing msf undefinedcooltypesing show...

Adobe CoolType SING Table "uniqueName" Stack Buffer Overflow

This module exploits a vulnerability in the Smart INdependent Glyplets SING table handling within versions 8.2.4 and 9.3.4 of Adobe Reader. Prior versions are assumed to be vulnerable as well. Module Options msf use exploit/windows/browser/adobe/cooltypesing msf undefinedcooltypesing show actions...

Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow

This module exploits a stack buffer overflow in Race river's Integard Home/Pro internet content filter HTTP Server. Versions prior to 2.0.0.9037 and 2.2.0.9037 are vulnerable. The administration web page on port 18881 is vulnerable to a remote buffer overflow attack. By sending a long character...

D-Link i2eye Video Conference AutoAnswer (WDBRPC)

This module can be used to enable auto-answer mode for the D-Link i2eye video conferencing system. Once this setting has been flipped, the device will accept incoming video calls without acknowledgement. The NetMeeting software included in Windows XP can be used to connect to this device. The i2e...

Apple Airport Extreme Password Extraction (WDBRPC)

This module can be used to read the stored password of a vulnerable Apple Airport Extreme access point. Only a small number of firmware versions have the WDBRPC service running, however the factory configuration was vulnerable. It appears that firmware versions 5.0.x as well as 5.1.x are...

ColdFusion Server Check

This module attempts to exploit the directory traversal in the 'locale' attribute. According to the advisory the following versions are vulnerable: ColdFusion MX6 6.1 base patches, ColdFusion MX7 7,0,0,91690 base patches, ColdFusion MX8 8,0,1,195765 base patches, ColdFusion MX8 8,0,1,195765 with...

Apple QuickTime 7.6.7 _Marshaled_pUnk Code Execution

This module exploits a memory trust issue in Apple QuickTime 7.6.7. When processing a specially-crafted HTML page, the QuickTime ActiveX control will treat a supplied parameter as a trusted pointer. It will then use it as a COM-type pUnknown and lead to arbitrary code execution. This exploit...

Linux Execute Command

Execute an arbitrary command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 29 include Msf::Payload::Single include...

Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 172 include Msf::Payload::Single include Msf::Payload::Linux::Armle::Prepends...

ProcessMaker Plugin Upload

This module will generate and upload a plugin to ProcessMaker resulting in execution of PHP code as the web server user. Credentials for a valid user account with Administrator roles is required to run this module. This module has been tested successfully on ProcessMaker versions 1.6-4276, 2.0.23...

Trend Micro Internet Security Pro 2010 ActiveX extSetOwner() Remote Code Execution

This module exploits a remote code execution vulnerability in Trend Micro Internet Security Pro 2010 ActiveX. When sending an invalid pointer to the extSetOwner function of UfPBCtrl.dll an attacker may be able to execute arbitrary code. Module Options msf use...

Windows Executable Download and Execute (via .vbs)

Download an EXE from an HTTPS URL and execute it This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Sessions::CommandShellOptions de...

Windows Execute net user /ADD CMD

Create a new user and add them to local administration group. Note: The specified password is checked for common complexity requirements to prevent the target machine rejecting the user for failing to meet policy requirements. Complexity check: 8-14 chars 1 UPPER, 1 lower, 1 digit/special This...

MicroP 0.1.1.1600 (MPPL File) Stack Buffer Overflow

This module exploits a vulnerability found in MicroP 0.1.1.1600. A stack-based buffer overflow occurs when the content of a .mppl file gets copied onto the stack, which overwrites the lpFileName parameter of a CreateFileA function, and results arbitrary code execution under the context of the use...

Command Shell, Java Bind TCP Stager

Spawn a piped command shell cmd.exe on Windows, /bin/sh everywhere else. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 5256 include Msf::Payload::Stager...

Java Meterpreter, Java Bind TCP Stager

Run a meterpreter server in Java. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 5256 include Msf::Payload::Stager include Msf::Payload::Java include...

Novell iPrint Client ActiveX Control call-back-url Buffer Overflow

This module exploits a stack-based buffer overflow in Novell iPrint Client 5.42. When sending an overly long string to the 'call-back-url' parameter in an op-client-interface-version action of ienipp.ocx an attacker may be able to execute arbitrary code. Module Options msf use...

SonicWALL Aventail epi.dll AuthCredential Format String

This module exploits a format string vulnerability within version 10.0.4.x and 10.5.1 of the SonicWALL Aventail SSL-VPN Endpoint Interrogator/Installer ActiveX control epi.dll. By calling the 'AuthCredential' method with a specially crafted Unicode format string, an attacker can cause memory...

Authentication Capture: SMTP

This module provides a fake SMTP service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: SMTP', 'Description' = %...

WebDAV Application DLL Hijacker

This module presents a directory of file extensions that can lead to code execution when opened from the share. The default EXTENSIONS option must be configured to specify a vulnerable application type. Module Options msf use exploit/windows/browser/webdav/dllhijacker msf undefineddllhijacker sho...

A-PDF WAV to MP3 v1.0.0 Buffer Overflow

This module exploits a buffer overflow in A-PDF WAV to MP3 v1.0.0. When the application is used to import a specially crafted m3u file, a buffer overflow occurs allowing arbitrary code execution. Module Options msf use exploit/windows/fileformat/a/pdfwavtomp3 msf undefinedpdfwavtomp3 show actions...

Apple QuickTime 7.6.6 Invalid SMIL URI Buffer Overflow

This module exploits a buffer overflow in Apple QuickTime 7.6.6. When processing a malformed SMIL uri, a stack-based buffer overflow can occur when logging an error message. Module Options msf use exploit/windows/browser/apple/quicktimesmildebug msf undefinedquicktimesmildebug show actions...

Microsoft Windows SRV.SYS SrvSmbQueryFsInformation Pool Overflow DoS

This module exploits a denial of service flaw in the Microsoft Windows SMB service on versions of Windows prior to the August 2010 Patch Tuesday. To trigger this bug, you must be able to access a share with at least read privileges. That generally means you will need authentication. However, if a...

Freesshd Authentication Bypass

This module exploits a vulnerability found in FreeSSHd use exploit/windows/ssh/freesshd/authbypass msf undefinedauthbypass show actions ...actions... msf undefinedauthbypass set ACTION msf undefinedauthbypass show options ...show and set options... msf undefinedauthbypass run This module requires...

DHCP Server

This module provides a DHCP service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DHCP Server', 'Description' = %q This module provides a DHCP service , 'Author' = 'scriptjunkie',...

JBoss Seam 2 File Upload and Execute

Versions of the JBoss Seam 2 framework use exploit/multi/http/jboss/seamuploadexec msf undefinedseamuploadexec show actions ...actions... msf undefinedseamuploadexec set ACTION msf undefinedseamuploadexec show options ...show and set options... msf undefinedseamuploadexec run This module requires...

Novell iPrint Client ActiveX Control ExecuteRequest debug Buffer Overflow

This module exploits a stack-based buffer overflow in Novell iPrint Client 5.40. When sending an overly long string to the 'debug' parameter in ExecuteRequest property of ienipp.ocx an attacker may be able to execute arbitrary code. Module Options msf use...

HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a request containing a cookie longer than 5120 bytes, an attacker can overflow a stack buffer and execute arbitrary code. The vulnerable code is within the OvWwwDebug function. The static-sized stack...

Amlibweb NetOpacs webquery.dll Stack Buffer Overflow

This module exploits a stack buffer overflow in Amlib's Amlibweb Library Management System NetOpacs. The webquery.dll API is available through IIS requests. By specifying an overly long string to the 'app' parameter, SeH can be reliably overwritten allowing for arbitrary remote code execution. In...

VxWorks WDB Agent Remote Reboot

This module provides the ability to reboot a VxWorks target through WDBRPC This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VxWorks WDB Agent Remote Reboot', 'Description' = %q This module...

VxWorks WDB Agent Version Scanner

Scan for exposed VxWorks wdbrpc daemons This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VxWorks WDB Agent Version Scanner', 'Description' = 'Scan for exposed VxWorks wdbrpc daemons', 'Author' =...

VxWorks WDB Agent Remote Memory Dump

This module provides the ability to dump the system memory of a VxWorks target through WDBRPC This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VxWorks WDB Agent Remote Memory Dump', 'Description...

VxWorks WDB Agent Boot Parameter Scanner

Scan for exposed VxWorks wdbrpc daemons and dump the boot parameters from memory This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VxWorks WDB Agent Boot Parameter Scanner', 'Description' = 'Scan...

WM Downloader 3.1.2.2 Buffer Overflow

This module exploits a buffer overflow in WM Downloader v3.1.2.2. When the application is used to import a specially crafted m3u file, a buffer overflow occurs allowing arbitrary code execution. Module Options msf use exploit/windows/fileformat/wm/downloaderm3u msf undefineddownloaderm3u show...