Accellion FTA MPIPE2 Command Execution

This module exploits a chain of vulnerabilities in the Accellion File Transfer appliance. This appliance exposes a UDP service on port 8812 that acts as a gateway to the internal communication bus. This service uses Blowfish encryption for authentication, but the appliance ships with two easy to...

EMC Replication Manager Command Execution

This module exploits a remote command-injection vulnerability in EMC Replication Manager client irccd.exe. By sending a specially crafted message invoking RunProgram function an attacker may be able to execute arbitrary commands with SYSTEM privileges. Affected products are EMC Replication Manage...

QuickShare File Server 1.2.1 Directory Traversal Vulnerability

This module exploits a vulnerability found in QuickShare File Server's FTP service. By supplying "../" in the file path, it is possible to trigger a directory traversal flaw, allowing the attacker to read a file outside the virtual directory. By default, the "Writable" option is enabled during...

VSFTPD 2.3.2 and Earlier STAT Denial of Service

This module triggers a Denial of Service condition in the VSFTPD server in versions before 2.3.3 tested on 2.3.0, 2.3.1, and 2.3.2. Version 2.3.3 and higher should not be vulnerable. Module Options msf use auxiliary/dos/ftp/vsftpd/232 msf undefined232 show actions ...actions... msf undefined232 s...

Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability

This module exploits a code execution vulnerability in Mozilla Firefox 3.6.x use exploit/windows/browser/mozilla/nstreerange msf undefinednstreerange show actions ...actions... msf undefinednstreerange set ACTION msf undefinednstreerange show options ...show and set options... msf...

AOL Desktop 9.6 RTX Buffer Overflow

This module exploits a vulnerability found in AOL Desktop 9.6's Tool\rich.rct component. By supplying a long string of data in the hyperlink tag, rich.rct copies this data into a buffer using a strcpy function, which causes an overflow, and results arbitrary code execution. Module Options msf use...

VideoLAN VLC MKV Memory Corruption

This module exploits an input validation error in VideoLAN VLC use exploit/windows/fileformat/vlc/webm msf undefinedwebm show actions ...actions... msf undefinedwebm set ACTION msf undefinedwebm show options ...show and set options... msf undefinedwebm run This module requires Metasploit:...

HP OpenView Performance Insight Server Backdoor Account Code Execution

This module exploits a hidden account in the com.trinagy.security.XMLUserManager Java class. When using this account, an attacker can abuse the com.trinagy.servlet.HelpManagerServlet class and write arbitrary files to the system allowing the execution of arbitrary code. NOTE: This module has only...

Real Networks Netzip Classic 7.5.1 86 File Parsing Buffer Overflow Vulnerability

This module exploits a stack-based buffer overflow vulnerability in version 7.5.1 86 of Real Networks Netzip Classic. In order for the command to be executed, an attacker must convince someone to load a specially crafted zip file with NetZip Classic. By doing so, an attacker can execute arbitrary...

Microsoft SQL Server Payload Execution via SQL Injection

This module will execute an arbitrary payload on a Microsoft SQL Server, using a SQL injection vulnerability. Once a vulnerability is identified this module will use xpcmdshell to upload and execute Metasploit payloads. It is necessary to specify the exact point where the SQL injection...

Windows Manage Local User Account Deletion

This module deletes a local user account from the specified server, or the local machine if no server is given. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Manage Local User Account...

SMB Domain User Enumeration

Determine what domain users are logged into a remote system via a DCERPC to NetWkstaUserEnum. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Domain User Enumeration', 'Description' =...

MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection

A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine MSDE without the updates supplied in MS09-00...

Windows Gather Local User Account SID Lookup

This module prints information about a given SID from the perspective of this session. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Local User Account SID Lookup', 'Descriptio...

GoldenFTP PASS Stack Buffer Overflow

This module exploits a vulnerability in the Golden FTP service, using the PASS command to cause a buffer overflow. Please note that in order trigger the vulnerable code, the victim machine must have the "Show new connections" setting enabled. By default, this option is unchecked. Module Options m...

Apache HTTPD mod_negotiation Filename Bruter

This module performs a brute force attack in order to discover existing files on a server which uses modnegotiation. If the filename is found, the IP address and the files found will be displayed. This module requires Metasploit: https://metasploit.com/download Current source:...

Apache HTTPD mod_negotiation Scanner

This module scans the webserver of the given hosts for the existence of modnegotiate. If the webserver has modnegotiation enabled, the IP address will be displayed. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework clas...

Citrix Provisioning Services 5.6 streamprocess.exe Buffer Overflow

This module exploits a stack buffer overflow in Citrix Provisioning Services 5.6. By sending a specially crafted packet to the Provisioning Services server, a fixed length buffer on the stack can be overflowed and arbitrary code can be executed. Module Options msf use...

Android Content Provider File Disclosure

This module exploits a cross-domain issue within the Android web browser to exfiltrate files from a vulnerable device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Content Provider...

Vagrant Synced Folder Vagrantfile Breakout

This module exploits a default Vagrant synced folder shared folder to append a Ruby payload to the Vagrant project Vagrantfile config file. By default, unless a Vagrant project explicitly disables shared folders, Vagrant mounts the project directory on the host as a writable 'vagrant' directory o...

Oracle Database Client System Analyzer Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability on the Client Analyzer component as included in Oracle Database 11g, which allows remote attackers to upload and execute arbitrary code. This module has been tested successfully on Oracle Database 11g 11.2.0.1.0 on Windows 2003 SP2, wher...

HTTP Client MS Credential Catcher

This module attempts to quietly catch NTLM/LM Challenge hashes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework NTLMCONST = Rex::Proto::NTLM::Constants NTLMCRYPT = Rex::Proto::NTLM::Crypt MESSAGE =...

Sielco Sistemi Winlog Buffer Overflow

This module exploits a buffer overflow in Sielco Sistem Winlog use exploit/windows/scada/winlog/runtime msf undefinedruntime show actions ...actions... msf undefinedruntime set ACTION msf undefinedruntime show options ...show and set options... msf undefinedruntime run This module requires...

Windows Gather SNMP Settings

This module will enumerate the SNMP service configuration. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather SNMP Settings', 'Description' = %q This module will enumerate the SNMP...

Windows Gather SMB Share Enumeration via Registry

This module will enumerate configured and recently used file shares. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather SMB Share Enumeration via Registry', 'Description' = %q This...

Windows Gather Installed Application Enumeration

This module will enumerate all installed applications on a Windows system This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Installed Application Enumeration', 'Description' = %q...

Windows Gather PowerShell Environment Setting Enumeration

This module will enumerate Microsoft PowerShell settings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather PowerShell Environment Setting Enumeration', 'Description' = %q This...

Windows Gather Logged On User Enumeration (Registry)

This module will enumerate current and recently logged on Windows users. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Logged On User Enumeration Registry', 'Description' = %q...

HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow

This module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs, the overflow occurs during a ov.sprintfnew call, which allows an attacker to overwrite data on the stack, and gain arbitrary code execution. Module Options msf use exploit/windows/http/hp/nnmnnmrptconfigschdparams msf...

HP OpenView NNM nnmRptConfig nameParams Buffer Overflow

This module exploits a vulnerability in HP NNM's nnmRptConfig.exe. A remote user can send a long string data to the nameParams parameter via a POST request, which causes an overflow on the stack when function ov.sprintfnew is used, and gain arbitrary code execution.' Module Options msf use...

ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)

This module exploits a stack-based buffer overflow in versions 1.2 through 1.3.0 of ProFTPD server. The vulnerability is within the "sreplace" function within the "src/support.c" file. The off-by-one heap overflow bug in the ProFTPD sreplace function has been discovered about 2 two years ago by...

Java Signed Applet Social Engineering Code Execution

This exploit dynamically creates a .jar file via the Msf::Exploit::Java mixin, then signs the it. The resulting signed applet is presented to the victim via a web page with an applet tag. The victim's JVM will pop a dialog asking if they trust the signed applet. On older versions the dialog will...

HP Data Protector Manager RDS DOS

This module causes a remote DOS on HP Data Protector's RDS service. By sending a malformed packet to port 1530, rm32.dll causes RDS to crash due to an enormous size for malloc. Module Options msf use auxiliary/dos/hp/data/protectorrds msf undefinedprotectorrds show actions ...actions... msf...

NetSupport Manager Agent Remote Buffer Overflow

This module exploits a buffer overflow in NetSupport Manager Agent. It uses a similar ROP to the proftpdiac exploit in order to avoid non executable stack. Module Options msf use exploit/linux/misc/netsupport/manageragent msf undefinedmanageragent show actions ...actions... msf...

Multi Gather Generic Operating System Environment Settings

This module prints out the operating system environment variables. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Multi Gather Generic Operating System Environment Settings', 'Description' = %...

SNMP Set Module

This module, similar to snmpset tool, uses the SNMP SET request to set information on a network entity. A OID numeric notation and a value are required. Target device must permit write access. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Speech API - Say "You Got Pwned!"

Causes the target to say "You Got Pwned" via the Windows Speech API This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework =begin https://www.exploit-db.com/sploits/w32-speaking-shellcode.zip Copyright c 2009-2010 Berend-Jan...

Synology Forget Password User Enumeration Scanner

This module attempts to enumerate users on the Synology NAS by sending GET requests for the forgot password URL. The Synology NAS will respond differently if a user is present or not. These count as login attempts, and the default is 10 logins in 5min to get a permanent block. Set delay according...

Windows Escalate UAC Protection Bypass (In Memory Injection)

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. This module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three separate binari...

Windows Escalate UAC Protection Bypass

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. Module Options msf use exploit/windows/local/bypassuac msf undefinedbypassuac show actions ...actions... msf...

Cisco IOS SNMP File Upload (TFTP)

This module will copy file to a Cisco IOS device using SNMP and TFTP. The action OverrideConfig will override the running config of the Cisco device. A read-write SNMP community is required. The SNMP community scanner module can assist in identifying a read-write community. The target must be abl...

Axis2 / SAP BusinessObjects Authenticated Code Execution (via SOAP)

This module logs in to an Axis2 Web Admin Module instance using a specific user/pass and uploads and executes commands via deploying a malicious web service by using SOAP. Module Options msf use exploit/multi/http/axis2/deployer msf undefineddeployer show actions ...actions... msf undefineddeploy...

Http:BL Lookup

This module can be used to enumerate information about an IP addresses from Project HoneyPot's HTTP Block List. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "net/dns/resolver" class MetasploitModule 'Http:B...

IPv6 Link Local/Node Local Ping Discovery

Send a ICMPv6 ping request to all default multicast addresses, and wait to see who responds. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IPv6 Link Local/Node Local Ping Discovery',...

IPv6 Local Neighbor Discovery Using Router Advertisement

Send a spoofed router advertisement with high priority to force hosts to start the IPv6 address auto-config. Monitor for IPv6 host advertisements, and try to guess the link-local address by concatenating the prefix, and the host portion of the IPv6 address. Use NDP host solicitation to determine ...

Kolibri HTTP Server HEAD Buffer Overflow

This exploits a stack buffer overflow in version 2 of the Kolibri HTTP server. Module Options msf use exploit/windows/http/kolibri/http msf undefinedhttp show actions ...actions... msf undefinedhttp set ACTION msf undefinedhttp show options ...show and set options... msf undefinedhttp run This...

SNMP Enumeration Module

This module allows enumeration of any devices with SNMP protocol support. It supports hardware, software, and network information. The default community used is "public". This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewor...

SNMP Windows SMB Share Enumeration

This module will use LanManager OID values to enumerate SMB shares on a Windows system via SNMP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SNMP Windows SMB Share Enumeration', 'Description...

SNMP Windows Username Enumeration

This module will use LanManager/psProcessUsername OID values to enumerate local user accounts on a Windows/Solaris system via SNMP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SNMP Windows...

Microsoft IIS FTP Server Encoded Response Overflow Trigger

This module triggers a heap overflow when processing a specially crafted FTP request containing Telnet IAC 0xff bytes. When constructing the response, the Microsoft IIS FTP Service overflows the heap buffer with 0xff bytes. This issue can be triggered pre-auth and may in fact be exploitable for...