Drupal Views Module Users Enumeration

This module exploits an information disclosure vulnerability in the 'Views' module of Drupal, brute-forcing the first 10 usernames from 'a' to 'z'. Drupal 6 with 'Views' module use auxiliary/scanner/http/drupal/viewsuserenum msf undefinedviewsuserenum show actions ...actions... msf...

LiteSpeed Source Code Disclosure/Download

This module exploits a source code disclosure/download vulnerability in versions 4.0.14 and prior of LiteSpeed. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'LiteSpeed Source Code...

Fake DNS Service

This module provides a DNS service that redirects all queries to a particular address. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'resolv' class MetasploitModule 'Fake DNS Service', 'Description' = %q Thi...

UFO: Alien Invasion IRC Client Buffer Overflow

This module exploits a buffer overflow in the IRC client component of UFO: Alien Invasion 2.2.1. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UFO: Alien Invasion IRC Client Buffer Overflow',...

UFO: Alien Invasion IRC Client Buffer Overflow

This module exploits a buffer overflow in the IRC client component of UFO: Alien Invasion 2.2.1. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'UFO: Alien Invasion IRC Client Buffer Overflow',...

Solaris KCMS + TTDB Arbitrary File Read

This module targets a directory traversal vulnerability in the kcmsserver component from the Kodak Color Management System. By utilizing the ToolTalk Database Server's TTISBUILD procedure, an attacker can bypass existing directory traversal validation and read arbitrary files. Vulnerable systems...

PHP Meterpreter, PHP Reverse TCP Stager

Run a meterpreter server in PHP. Reverse PHP connect back stager with checks for disabled functions This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1116 include Msf::Payload::Stage...

Generic Payload Handler

This module is a stub that provides all of the features of the Metasploit payload system to exploits that have been launched outside of the framework. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

JBoss Vulnerability Scanner

This module scans a JBoss instance for a few vulnerabilities. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'JBoss Vulnerability Scanner', 'Description' = %q This module scans a JBoss instance...

SMB Session Pipe Auditor

Determine what named pipes are accessible over SMB This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Session Pipe Auditor', 'Description' = 'Determine what named pipes are accessible over SMB...

Nginx Source Code Disclosure/Download

This module exploits a source code disclosure/download vulnerability in versions 0.7 and 0.8 of the nginx web server. Versions 0.7.66 and 0.8.40 correct this vulnerability. This module requires Metasploit: https://metasploit.com/download Current source:...

HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. This vulnerability is...

HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. This vulnerability is...

Samba chain_reply Memory Corruption (Linux x86)

This exploits a memory corruption vulnerability present in Samba versions prior to 3.3.13. When handling chained response packets, Samba fails to validate the offset value used when building the next part. By setting this value to a number larger than the destination buffer size, an attacker can...

Microsoft Visual Studio Mdmask32.ocx ActiveX Buffer Overflow

This module exploits a stack buffer overflow in Microsoft's Visual Studio 6.0. When passing a specially crafted string to the Mask parameter of the Mdmask32.ocx ActiveX Control, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download...

Samba trans2open Overflow (*BSD x86)

This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the flaw on x86 Linux systems that do not have the noexec stack option set. This module requires Metasploit: https://metasploit.com/download Current source:...

Titan FTP XCRC Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability in the XCRC command implemented in versions of Titan FTP up to and including 8.10.1125. By making sending multiple XCRC command, it is possible to disclose the contents of any file on the drive with a simple CRC "brute force" attack. Althou...

Samba trans2open Overflow (Linux x86)

This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the flaw on x86 Linux systems that do not have the noexec stack option set. NOTE: Some older versions of RedHat do not seem to be vulnerable since they apparently do not allow...

UnrealIRCD 3.2.8.1 Backdoor Command Execution

This module exploits a malicious backdoor that was added to the Unreal IRCD 3.2.8.1 download archive. This backdoor was present in the Unreal3.2.8.1.tar.gz archive between November 2009 and June 12th 2010. Module Options msf use exploit/unix/irc/unreal/ircd3281backdoor msf undefinedircd3281backdo...

Apache Axis2 v1.4.1 Local File Inclusion

This module exploits an Apache Axis2 v1.4.1 local file inclusion LFI vulnerability. By loading a local XML file which contains a cleartext username and password, attackers can trivially recover authentication credentials to Axis services. This module requires Metasploit:...

CPUID-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on CPUID and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'CPUID-based Context Keyed Payload Encoder',...

time(2)-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on time2 and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'time2-based Context Keyed Payload Encoder',...

stat(2)-based Context Keyed Payload Encoder

This is a Context-Keyed Payload Encoder based on stat2 and Shikata Ga Nai. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/poly' class MetasploitModule 'stat2-based Context Keyed Payload Encoder',...

Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability

This module exploits a vulnerability found in Oracle BeeHive. The processEvaluation method found in voice-servlet can be abused to write a malicious file onto the target machine, and gain remote arbitrary code execution under the context of SYSTEM. Module Options msf use...

Microsoft Help Center XSS and Command Execution

Help and Support Center is the default application provided to access online documentation for Microsoft Windows. Microsoft supports accessing help documents directly via URLs by installing a protocol handler for the scheme "hcp". Due to an error in validation of input to hcp:// combined with a...

HP OpenView Network Node Manager ovwebsnmpsrv.exe Unrecognized Option Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe' CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code is withi...

MS11-038 Microsoft Office Excel Malformed OBJ Record Handling Overflow

This module exploits a vulnerability found in Excel 2002 of Microsoft Office XP. By supplying a .xls file with a malformed OBJ recType 0x5D record an attacker can get the control of the execution flow. This results in arbitrary code execution under the context of the user. Module Options msf use...

Easy CD-DA Recorder PLS Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in Easy CD-DA Recorder 2007 caused by an overlong string in a playlist entry. By persuading the victim to open a specially-crafted PLS file, a remote attacker can execute arbitrary code on the system or cause the application to cras...

Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger

This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in the MDSYS.SDOTOPODROPFTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme 2-stage attack. This module...

Novell ZENworks Configuration Management Remote Execution

This module exploits a code execution flaw in Novell ZENworks Configuration Management 10.2.0. By exploiting the UploadServlet, an attacker can upload a malicious file outside of the TEMP directory and then make a secondary request that allows for arbitrary code execution. This module requires...

S.O.M.P.L 1.0 Player Buffer Overflow

This module exploits a buffer overflow in Simple Open Music Player v1.0. When the application is used to import a specially crafted m3u file, a buffer overflow occurs allowing arbitrary code execution. This module requires Metasploit: https://metasploit.com/download Current source:...

Adobe Flash Player "newfunction" Invalid Pointer Use

This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash...

Adobe Flash Player "newfunction" Invalid Pointer Use

This module exploits a vulnerability in the DoABC tag handling within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achieved by embedding a specially crafted Flash...

HTTP Open Proxy Detection

Checks if an HTTP proxy is open. False positive are avoided verifying the HTTP return code and matching a pattern. The CONNECT method is verified only the return code. HTTP headers are shown regarding the use of proxy or load balancer. This module requires Metasploit:...

SMTP Simple Fuzzer

SMTP Simple Fuzzer This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework A Very simple Module to fuzzer some SMTP commands. It allows to respect the order or just throw everything at it.... class MetasploitModule 'SMTP Simp...

FeedDemon Stack Buffer Overflow

This module exploits a buffer overflow in FeedDemon v3.1.0.12. When the application is used to import a specially crafted opml file, a buffer overflow occurs allowing arbitrary code execution. All versions are suspected to be vulnerable. This vulnerability was originally reported against version...

MacOS X EvoCam HTTP GET Buffer Overflow

This module exploits a stack buffer overflow in the web server provided with the EvoCam program for Mac OS X. We use Dino Dai Zovi's exec-from-heap technique to copy the payload from the non-executable stack segment to heap memory. Vulnerable versions include 3.6.6, 3.6.7, and possibly earlier...

Outlook ATTACH_BY_REF_ONLY File Execution

It has been discovered that certain e-mail message cause Outlook to create Windows shortcut-like attachments or messages within Outlook. Through specially crafted TNEF streams with certain MAPI attachment properties, it is possible to set a path name to files to be executed. When a user double...

Outlook ATTACH_BY_REF_RESOLVE File Execution

It has been discovered that certain e-mail message cause Outlook to create Windows shortcut-like attachments or messages within Outlook. Through specially crafted TNEF streams with certain MAPI attachment properties, it is possible to set a path name to files to be executed. When a user double...

SIP Endpoint Scanner (TCP)

Scan for SIP devices using OPTIONS requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Endpoint Scanner TCP', 'Description' = 'Scan for SIP devices using OPTIONS requests', 'Author' =...

SIP Username Enumerator (TCP)

Scan for numeric username/extensions using OPTIONS/REGISTER requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Username Enumerator TCP', 'Description' = 'Scan for numeric...

SolarWinds TFTP Server 10.4.0.10 Denial of Service

The SolarWinds TFTP server can be shut down by sending a 'netascii' read request with a specially crafted file name. Module Options msf use auxiliary/dos/windows/tftp/solarwinds msf undefinedsolarwinds show actions ...actions... msf undefinedsolarwinds set ACTION msf undefinedsolarwinds show...

CommuniCrypt Mail 1.16 SMTP ActiveX Stack Buffer Overflow

This module exploits a stack buffer overflow in the ANSMTP.dll/AOSMTP.dll ActiveX Control provided by CommuniCrypt Mail 1.16. By sending an overly long string to the "AddAttachments" method, an attacker may be able to execute arbitrary code. Module Options msf use...

MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow

This module exploits a stack buffer overflow vulnerability in the handling of the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft, the PowerPoint Viewer distributed with Office 2003 SP3 and earlier, as well as Office 2004 for Mac, are vulnerable. NOTE: The vulnerable...

HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow

This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted Hostname parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmgetnnmdatahostname msf...

HP OpenView Network Node Manager snmpviewer.exe Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53 prior to NNM01203. By making a specially crafted HTTP request to the "snmpviewer.exe" CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code. The vulnerable code lies within ...

HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow

This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted MaxAge parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmgetnnmdatamaxage msf...

HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow

This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53. By sending specially crafted ICount parameter to the getnnmdata.exe CGI, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmgetnnmdataicount msf...

PointDev IDEAL Migration Buffer Overflow

This module exploits a stack buffer overflow in versions v9.7 through v10.5 of IDEAL Administration and versions 4.5 and 4.51 of IDEAL Migration. All versions are suspected to be vulnerable. By creating a specially crafted ipj file, an attacker may be able to execute arbitrary code. NOTE: IDEAL...

OpenX banner-edit.php File Upload PHP Code Execution

This module exploits a vulnerability in the OpenX advertising software. In versions prior to version 2.8.2, authenticated users can upload files with arbitrary extensions to be used as banner creative content. By uploading a file with a PHP extension, an attacker can execute arbitrary PHP code...