Titan FTP XCRC Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability in the XCRC command implemented in versions of Titan FTP up to and including 8.10.1125. By making sending multiple XCRC command, it is possible to disclose the contents of any file on the drive with a simple CRC "brute force" attack. Althou...

UnrealIRCD 3.2.8.1 Backdoor Command Execution

This module exploits a malicious backdoor that was added to the Unreal IRCD 3.2.8.1 download archive. This backdoor was present in the Unreal3.2.8.1.tar.gz archive between November 2009 and June 12th 2010. Module Options msf use exploit/unix/irc/unreal/ircd3281backdoor msf undefinedircd3281backdo...

Apache Axis2 v1.4.1 Local File Inclusion

This module exploits an Apache Axis2 v1.4.1 local file inclusion LFI vulnerability. By loading a local XML file which contains a cleartext username and password, attackers can trivially recover authentication credentials to Axis services. This module requires Metasploit:...

CPUID-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on CPUID and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'CPUID-based Context Keyed Payload Encoder',...

stat(2)-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on stat2 and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'stat2-based Context Keyed Payload Encoder',...

time(2)-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on time2 and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'time2-based Context Keyed Payload Encoder',...

Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability

This module exploits a vulnerability found in Oracle BeeHive. The processEvaluation method found in voice-servlet can be abused to write a malicious file onto the target machine, and gain remote arbitrary code execution under the context of SYSTEM. Module Options msf use...

Microsoft Help Center XSS and Command Execution

Help and Support Center is the default application provided to access online documentation for Microsoft Windows. Microsoft supports accessing help documents directly via URLs by installing a protocol handler for the scheme "hcp". Due to an error in validation of input to hcp:// combined with a...

MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow

This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP. By supplying a .xls file with a malformed OBJ recType 0x5D record an attacker can get the control of the execution flow. This results in arbitrary code execution under the context of the user. Module Options msf use...

HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code is withi...

Easy CD-DA Recorder PLS Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in Easy CD-DA Recorder 2007 caused by an overlong string in a playlist entry. By persuading the victim to open a specially-crafted PLS file, a remote attacker can execute arbitrary code on the system or cause the application to cras...

Adobe Flash Player "newfunction" Invalid Pointer Use

This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash...

Adobe Flash Player "newfunction" Invalid Pointer Use

This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash...

HTTP Open Proxy Detection

Checks if an HTTP proxy is open. False positive are avoided verifying the HTTP return code and matching a pattern. The CONNECT method is verified only the return code. HTTP headers are shown regarding the use of proxy or load balancer. This module requires Metasploit:...

SMTP Simple Fuzzer

SMTP Simple Fuzzer This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework A Very simple Module to fuzzer some SMTP commands. It allows to respect the order or just throw everything at it.... class MetasploitModule 'SMTP Simp...

Outlook ATTACH_BY_REF_ONLY File Execution

It has been discovered that certain e-mail message cause Outlook to create Windows shortcut-like attachments or messages within Outlook. Through specially crafted TNEF streams with certain MAPI attachment properties, it is possible to set a path name to files to be executed. When a user double...

MacOS X EvoCam HTTP GET Buffer Overflow

This module exploits a stack buffer overflow in the web server provided with the EvoCam program for Mac OS X. We use Dino Dai Zovi's exec-from-heap technique to copy the payload from the non-executable stack segment to heap memory. Vulnerable versions include 3.6.6, 3.6.7, and possibly earlier...

Outlook ATTACH_BY_REF_RESOLVE File Execution

It has been discovered that certain e-mail message cause Outlook to create Windows shortcut-like attachments or messages within Outlook. Through specially crafted TNEF streams with certain MAPI attachment properties, it is possible to set a path name to files to be executed. When a user double...

SIP Username Enumerator (TCP)

Scan for numeric username/extensions using OPTIONS/REGISTER requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Username Enumerator TCP', 'Description' = 'Scan for numeric...

SIP Endpoint Scanner (TCP)

Scan for SIP devices using OPTIONS requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Endpoint Scanner TCP', 'Description' = 'Scan for SIP devices using OPTIONS requests', 'Author' =...

SolarWinds TFTP Server 10.4.0.10 Denial of Service

The SolarWinds TFTP server can be shut down by sending a 'netascii' read request with a specially crafted file name. Module Options msf use auxiliary/dos/windows/tftp/solarwinds msf undefinedsolarwinds show actions ...actions... msf undefinedsolarwinds set ACTION msf undefinedsolarwinds show...

CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow

This module exploits a stack buffer overflow in the ANSMTP.dll/AOSMTP.dll ActiveX Control provided by CommuniCrypt Mail 1.16. By sending an overly long string to the "AddAttachments" method, an attacker may be able to execute arbitrary code. Module Options msf use...

HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow

This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted MaxAge parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmgetnnmdatamaxage msf...

HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01203. By making a specially crafted HTTP request to the "snmpviewer.exe" CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code lies within ...

HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow

This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted ICount parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmgetnnmdataicount msf...

HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow

This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted Hostname parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmgetnnmdatahostname msf...

HP Mercury LoadRunner Agent magentproc.exe Remote Command Execution

This module exploits a remote command execution vulnerablity in HP LoadRunner before 9.50 and also HP Performance Center before 9.50. HP LoadRunner 12.53 and other versions are also most likely vulneable if the non-default SSL option is turned off. By sending a specially crafted packet, an attack...

Lotus Domino Brute Force Utility

Lotus Domino Authentication Brute Force Utility This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lotus Domino Brute Force Utility', 'Description' = 'Lotus Domino Authentication Brute Force...

Lotus Domino Version

Several checks to determine Lotus Domino Server Version. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lotus Domino Version', 'Description' = 'Several checks to determine Lotus Domino Server...

Microsoft Office Visio VISIODWG.DLL DXF File Handling Vulnerability

This module exploits a stack based overflow vulnerability in the handling of the DXF files by Microsoft Visio 2002. Revisions prior to the release of the MS bulletin MS10-028 are vulnerable. The overflow occurs when the application is used to import a specially crafted DXF file, while parsing the...

JBoss Java Class DeploymentFileRepository WAR Deployment

This module uses the DeploymentFileRepository class in JBoss Application Server jbossas to deploy a JSP file which then deploys the WAR file. Module Options msf use exploit/multi/http/jboss/deploymentfilerepository msf undefineddeploymentfilerepository show actions ...actions... msf...

Maple Maplet File Creation and Command Execution

This module harnesses Maple's ability to create files and execute commands automatically when opening a Maplet. All versions up to 13 are suspected vulnerable. Testing was conducted with version 13 on Windows. Standard security settings prevent code from running in a normal maple worksheet withou...

Oracle DB SQL Injection via SYS.DBMS_CDC_PUBLISH.DROP_CHANGE_SOURCE

The module exploits an sql injection flaw in the DROPCHANGESOURCE procedure of the PL/SQL package DBMSCDCPUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTECATALOGROLE have the required privilege. Module Options msf...

JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. Module Options msf use exploit/multi/http/jboss/bshdeployer msf...

Xftp FTP Client 3.0 PWD Remote Buffer Overflow

This module exploits a buffer overflow in the Xftp 3.0 FTP client that is triggered through an excessively long PWD message. Module Options msf use exploit/windows/ftp/xftp/clientpwd msf undefinedclientpwd show actions ...actions... msf undefinedclientpwd set ACTION msf undefinedclientpwd show...

AgentX++ Master AgentX::receive_agentx Stack Buffer Overflow

This exploits a stack buffer overflow in the AgentX++ library, as used by various applications. By sending a specially crafted request, an attacker can execute arbitrary code, potentially with SYSTEM privileges. This module was tested successfully against master.exe as included with Real Network'...

Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference

This module exploits an out of bounds function table dereference in the SMB request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7 release candidates not RTM, and Windows 2008 Server prior to R2. Windows Vista without SP1 does not seem affected by this flaw. This...

Microsoft SRV2.SYS SMB2 Logoff Remote Kernel NULL Pointer Dereference

This module triggers a NULL pointer dereference in the SRV2.SYS kernel driver when processing an SMB2 logoff request before a session has been correctly negotiated, resulting in a BSOD. Effecting Vista SP1/SP2 And possibly Server 2008 SP1/SP2, the flaw was resolved with MS09-050. This module...

Microsoft Windows 7 / Server 2008 R2 SMB Client Infinite Loop

This module exploits a denial of service flaw in the Microsoft Windows SMB client on Windows 7 and Windows Server 2008 R2. To trigger this bug, run this module as a service and forces a vulnerable client to access the IP of this system as an SMB server. This can be accomplished by embedding a UNC...

Generic x86 Tight Loop

Generate a tight loop in the target process This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 2 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo, 'Name' = 'Generi...

Windows Media Services ConnectFunnel Stack Buffer Overflow

This module exploits a stack buffer overflow in the Windows Media Unicast Service version 4.1.0.3930 NUMS.exe. By sending a specially crafted FunnelConnect request, an attacker can execute arbitrary code under the "NetShowServices" user account. Windows Media Services 4.1 ships with Windows 2000...

MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow

This module exploits a buffer overflow in l3codecx.ax while processing a AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite with 0's so the three least significant bytes of EIP saved on stack are overwritten and shellcode is mapped using the .NET DLL memory techniqu...

Trellian FTP Client 3.01 PASV Remote Buffer Overflow

This module exploits a buffer overflow in the Trellian 3.01 FTP client that is triggered through an excessively long PASV message. Module Options msf use exploit/windows/ftp/trellian/clientpasv msf undefinedclientpasv show actions ...actions... msf undefinedclientpasv set ACTION msf...

Sun Java Web Start Plugin Command Line Argument Injection

This module exploits a flaw in the Web Start plugin component of Sun Java Web Start. The arguments passed to Java Web Start are not properly validated. By passing the lesser known -J option, an attacker can pass arbitrary options directly to the Java runtime. By utilizing the -XXaltjvm option, as...

HTTP Vuln Scanner

This module identifies common vulnerable files or cgis. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Vuln Scanner', 'Description' = %q This module identifies common vulnerable files or...

SMB SID User Enumeration (LookupSid)

Determine what users exist via brute force SID lookups. This module can enumerate both local and domain accounts by setting ACTION to either LOCAL or DOMAIN This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

AjaXplorer checkInstall.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the AjaXplorer 'checkInstall.php' script. All versions of AjaXplorer prior to 2.6 are vulnerable. Module Options msf use exploit/multi/http/ajaxplorer/checkinstallexec msf undefinedcheckinstallexec show actions ...actions... msf...

EasyFTP Server MKD Command Stack Buffer Overflow

This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11 and earlier. EasyFTP fails to check input size when parsing 'MKD' commands, which leads to a stack based buffer overflow. NOTE: EasyFTP allows anonymous access by default. However, in order to access the 'MKD' command,...

Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (wininet)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTPS Windows wininet This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework modu...

Windows Meterpreter (Reflective Injection), Reverse TCP Stager (DNS)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...