Shadow Stream Recorder 3.0.1.7 Buffer Overflow

This module exploits a buffer overflow in Shadow Stream Recorder 3.0.1.7. Using the application to open a specially crafted asx file, a buffer overflow may occur to allow arbitrary code execution under the context of the user. Module Options msf use...

PostgreSQL Version Probe

Enumerates the version of PostgreSQL servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PostgreSQL Version Probe', 'Description' = %q Enumerates the version of PostgreSQL servers. ,...

Steinberg MyMP3Player 3.0 Buffer Overflow

This module exploits a stack buffer overflow in Steinberg MyMP3Player == 3.0. When the application is used to open a specially crafted m3u file, a buffer overflow occurs allowing arbitrary code execution. Module Options msf use exploit/windows/fileformat/mymp3player/m3u msf undefinedm3u show...

Windows AlwaysInstallElevated MSI

This module checks the AlwaysInstallElevated registry keys which dictates if .MSI files should be installed with elevated privileges NT AUTHORITY\SYSTEM. The generated .MSI file has an embedded executable which is extracted and run by the installer. After execution the .MSI file intentionally fai...

VariCAD 2010-2.05 EN (DWB File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in VariCAD 2010-2.05 EN. An attacker must send the file to victim and the victim must open the file. Module Options msf use exploit/windows/fileformat/varicad/dwb msf undefineddwb show actions ...actions... msf undefineddwb set ACTION msf...

Java Debug Wire Protocol Remote Code Execution

This module abuses exposed Java Debug Wire Protocol services in order to execute arbitrary Java code remotely. It just abuses the protocol features, since no authentication is required if the service is enabled. Module Options msf use exploit/multi/misc/java/jdwpdebugger msf undefinedjdwpdebugger...

Oracle XML DB SID Discovery via Brute Force

This module attempts to retrieve the sid from the Oracle XML DB httpd server, utilizing Pete Finnigan's default oracle password list. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle XML ...

MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption

This module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet Explorer are vulnerable. By specifying a long value as the "DataURL" parameter to this control, it is possible to write a NUL byte...

MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free

This module exploits a use-after-free vulnerability within the DHTML behaviors functionality of Microsoft Internet Explorer versions 6 and 7. This bug was discovered being used in-the-wild and was previously known as the "iepeers" vulnerability. The name comes from Microsoft's suggested workaroun...

Energizer DUO Trojan Scanner

Detect instances of the Energizer DUO trojan horse software on port 7777 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Energizer DUO Trojan Scanner', 'Description' = 'Detect instances of the...

Apache mod_isapi Dangling Pointer

This module triggers a use-after-free vulnerability in the Apache Software Foundation modisapi extension for versions 2.2.14 and earlier. In order to reach the vulnerable code, the target server must have an ISAPI module installed and configured. By making a request that terminates abnormally...

Energizer DUO USB Battery Charger Arucer.dll Trojan Code Execution

This module will execute an arbitrary payload against any system infected with the Arugizer trojan horse. This backdoor was shipped with the software package accompanying the Energizer DUO USB battery charger. Module Options msf use exploit/windows/backdoor/energizer/duopayload msf...

Viscom Image Viewer CP Pro 8.0/Gold 6.0 ActiveX Control

This module exploits a stack based buffer overflow in the Active control file ImageViewer2.OCX by passing an overly long argument to an insecure TifMergeMultiFiles method. Exploitation results in code execution with the privileges of the user who browsed to the exploit page. The victim will first...

Orbital Viewer ORB File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in David Manthey's Orbital Viewer. When processing .ORB files, data is read from file into a fixed-size stack buffer using the fscanf function. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by...

IMAP4 Banner Grabber

IMAP4 Banner Grabber This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IMAP4 Banner Grabber', 'Description' = 'IMAP4 Banner Grabber', 'Author' = 'hdm', 'License' = MSFLICENSE end def runhostip...

POP3 Banner Grabber

POP3 Banner Grabber This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'POP3 Banner Grabber', 'Description' = 'POP3 Banner Grabber', 'Author' = 'hdm', 'License' = MSFLICENSE registeroptions...

SMTP Banner Grabber

SMTP Banner Grabber This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMTP Banner Grabber', 'Description' = 'SMTP Banner Grabber', 'References' = 'URL', 'http://www.ietf.org/rfc/rfc2821.txt', ,...

MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution

This module exploits a code execution vulnerability that occurs when a user presses F1 on MessageBox originated from VBscript within a web page. When the user hits F1, the MessageBox help functionality will attempt to load and use a HLP file from an SMB or WebDAV if the WebDAV redirector is enabl...

EasyFTP Server list.html path Stack Buffer Overflow

This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11 and earlier. EasyFTP fails to check input size when parsing the 'path' parameter supplied to an HTTP GET request, which leads to a stack based buffer overflow. EasyFTP allows anonymous access by default; valid credentia...

EasyFTP Server CWD Command Stack Buffer Overflow

This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11 and earlier. EasyFTP fails to check input size when parsing 'CWD' commands, which leads to a stack based buffer overflow. EasyFTP allows anonymous access by default; valid credentials are typically unnecessary to exploi...

Adobe Acrobat Bundled LibTIFF Integer Overflow

This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions 8.0 through 8.2 and 9.0 through 9.3. Module Options msf use exploit/windows/fileformat/adobe/libtiff msf undefinedlibtiff show actions ...actions... msf undefinedlibtiff set ACTION msf...

Hyleos ChemView ActiveX Control Stack Buffer Overflow

This module exploits a stack-based buffer overflow within version 1.9.5.1 of Hyleos ChemView HyleosChemView.ocx. By calling the 'SaveAsMolFile' or 'ReadMolFile' methods with an overly long first argument, an attacker can overrun a buffer and execute arbitrary code. Module Options msf use...

SMB User Enumeration (SAM EnumUsers)

Determine what users exist via the SAM RPC service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB User Enumeration SAM EnumUsers', 'Description' = 'Determine what users exist via the SAM R...

MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow

This module exploits a stack buffer overflow vulnerability in the handling of the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft, the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as well as Office 2004 for Mac, are vulnerable. NOTE: The vulnerable...

PostgreSQL Server Generic Query

This module imports a file local on the PostgreSQL Server into a temporary table, reads it, and then drops the temporary table. It requires PostgreSQL credentials with table CREATE privileges as well as read privileges to the target file. This module requires Metasploit:...

AIX execve Shell for inetd

Simply execve /bin/sh for inetd programs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 56 include Msf::Payload::Single include Msf::Payload::Aix include...

Samba Symlink Directory Traversal

This module exploits a directory traversal flaw in the Samba CIFS server. To exploit this flaw, a writeable share must be specified. The newly created directory will link to the root filesystem. This module requires Metasploit: https://metasploit.com/download Current source:...

Juniper JunOS Malformed TCP Option

This module exploits a denial of service vulnerability in Juniper Network's JunOS router operating system. By sending a TCP packet with TCP option 101 set, an attacker can cause an affected router to reboot. This module requires Metasploit: https://metasploit.com/download Current source:...

PostgreSQL Server Generic Query

This module will allow for simple SQL statements to be executed against a PostgreSQL instance given the appropriate credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PostgreSQL Serve...

HTTP trace.axd Content Scanner

Detect trace.axd files and analyze its content This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP trace.axd Content Scanner', 'Description' = 'Detect trace.axd files and analyze its content',...

HTTP Directory Listing Scanner

This module identifies directory listing vulnerabilities in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Directory Listing Scanner', 'Description' = %q This modu...

HTTP SSL Certificate Information

Parse the server SSL certificate to obtain the common name and signature algorithm...

HTTP Backup File Scanner

This module identifies the existence of possible copies of a specific file in a given path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Backup File Scanner', 'Description' = %q This...

HTTP Virtual Host Brute Force Scanner

This module tries to identify unique virtual hosts hosted by the target web server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework May I reuse some methods? require 'cgi' class MetasploitModule 'HTTP Virtual Host Bru...

HTTP WebDAV Scanner

Detect webservers with WebDAV enabled This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Scanner', 'Description' = 'Detect webservers with WebDAV enabled', 'Author' = 'et', 'License' =...

HTTP Robots.txt Content Scanner

Detect robots.txt files and analyze its content This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Robots.txt Content Scanner', 'Description' = 'Detect robots.txt files and analyze its...

HTTP Subversion Scanner

Detect subversion directories and files and analyze its content. Only SVN Version 7 supported This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Subversion Scanner', 'Description' = 'Detect...

HTTP File Same Name Directory Scanner

This module identifies the existence of files in a given directory path named as the same name of the directory. Only works if PATH is different than '/'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

HTTP Directory Scanner

This module identifies the existence of interesting directories in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'thread' class MetasploitModule 'HTTP Directory Scanner', 'Description...

HTTP Error Based SQL Injection Scanner

This module identifies the existence of Error Based SQL injection issues. Still requires a lot of work This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Error Based SQL Injection Scanner',...

HTTP SOAP Verb/Noun Brute Force Scanner

This module attempts to brute force SOAP/XML requests to uncover hidden methods. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP SOAP Verb/Noun Brute Force Scanner', 'Description' = %q Thi...

HTTP Interesting File Scanner

This module identifies the existence of interesting files in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Interesting File Scanner', 'Description' = %q This modu...

MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner

This module is based on et's HTTP Directory Scanner module, with one exception. Where authentication is required, it attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS...

HTTP WebDAV Internal IP Scanner

Detect webservers internal IPs though WebDAV This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Internal IP Scanner', 'Description' = 'Detect webservers internal IPs though WebDAV',...

HTTP File Extension Scanner

This module identifies the existence of additional files by modifying the extension of an existing file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'pathname' class MetasploitModule 'HTTP File Extension...

HTTP Directory Brute Force Scanner

This module identifies the existence of interesting directories by brute forcing the name in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'HTTP...

HTTP WebDAV Website Content Scanner

Detect webservers disclosing its content though WebDAV This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Website Content Scanner', 'Description' = 'Detect webservers disclosing its...

HTTP Previous Directory File Scanner

This module identifies files in the first parent directory with same name as the given directory path. Example: Test /backup/files/ will look for the following files /backup/files.ext . This module requires Metasploit: https://metasploit.com/download Current source:...

HTTP Copy File Scanner

This module identifies the existence of possible copies of a specific file in a given path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Copy File Scanner', 'Description' = %q This modu...

HTTP SSL Certificate Checker

This module will check the certificate of the specified web servers to ensure the subject and issuer match the supplied pattern and that the certificate is not expired. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...