FreeBSD rtld execl() Privilege Escalation

This module exploits a vulnerability in the FreeBSD run-time link-editor rtld. The rtld unsetenv function fails to remove LD environment variables if findenv fails. This can be abused to load arbitrary shared objects using LDPRELOAD, resulting in privileged code execution. This module has been...

OpenX banner-edit.php File Upload PHP Code Execution

This module exploits a vulnerability in the OpenX advertising software. In versions prior to version 2.8.2, authenticated users can upload files with arbitrary extensions to be used as banner creative content. By uploading a file with a PHP extension, an attacker can execute arbitrary PHP code...

Erlang Port Mapper Daemon Cookie RCE

The erlang port mapper daemon is used to coordinate distributed erlang instances. Should an attacker get the authentication cookie RCE is trivial. Usually, this cookie is named ".erlang.cookie" and varies on location. Module Options msf use exploit/multi/misc/erlang/cookierce msf undefinedcookier...

MS09-072 Microsoft Internet Explorer Style getElementsByTagName Memory Corruption

This module exploits a vulnerability in the getElementsByTagName function as implemented within Internet Explorer. Module Options msf use exploit/windows/browser/ms09/072styleobject msf undefined072styleobject show actions ...actions... msf undefined072styleobject set ACTION msf...

Citrix MetaFrame ICA Published Applications Scanner

This module attempts to query Citrix Metaframe ICA server to obtain a published list of applications. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Citrix MetaFrame ICA Published Applications...

Citrix MetaFrame ICA Published Applications Bruteforcer

This module attempts to brute force program names within the Citrix Metaframe ICA server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Citrix MetaFrame ICA Published Applications Bruteforcer...

Bourne ${IFS} Substitution Command Encoder

This encoder uses Bourne $IFS substitution to avoid whitespace without being overly fancy. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Bourne $IFS Substitution Command Encoder', 'Descriptio...

HTTPDX tolog() Function Format String Vulnerability

This module exploits a format string vulnerability in HTTPDX HTTP server. By sending a specially crafted HTTP request containing format specifiers, an attacker can corrupt memory and execute arbitrary code. By default logging is off for HTTP, but enabled for the 'moderator' user via FTP. Module...

HTTPDX tolog() Function Format String Vulnerability

This module exploits a format string vulnerability in HTTPDX FTP server. By sending a specially crafted FTP command containing format specifiers, an attacker can corrupt memory and execute arbitrary code. By default logging is off for HTTP, but enabled for the 'moderator' user via FTP. Module...

AwingSoft Winds3D Player 3.5 SceneURL Download and Execute

This module exploits an untrusted program execution vulnerability within the Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for IE ActiveX, Opera DLL and Firefox XPI. By setting the 'SceneURL' parameter to the URL to an executable, an attacker can execute arbitrary code...

Novell eDirectory DHOST Predictable Session Cookie

This module is able to predict the next session cookie value issued by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run this module, wait until the real administrator logs in, then specify the predicted cookie value to hijack their session. This module requires Metasploit:...

Microsoft Windows EOT Font Table Directory Integer Overflow

This module exploits an integer overflow flaw in the Microsoft Windows Embedded OpenType font parsing code located in win32k.sys. Since the kernel itself parses embedded web fonts, it is possible to trigger a BSoD from a normal web page when viewed with Internet Explorer. Module Options msf use...

MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability

This module exploits a vulnerability in the handling of the FEATHEADER record by Microsoft Excel. Revisions of Office XP and later prior to the release of the MS09-067 bulletin are vulnerable. When processing a FEATHEADER Shared Feature record, Microsoft used a data structure from the file to...

Apache Tomcat Manager Application Deployer Authenticated Code Execution

This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is no...

Apache Tomcat Manager Authenticated Upload Code Execution

This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets vary based on...

Sun Java JRE getSoundbank file:// URI Buffer Overflow

This module exploits a flaw in the getSoundbank function in the Sun JVM. The payload is serialized and passed to the applet via PARAM tags. It must be a native payload. The effected Java versions are JDK and JRE 6 Update 16 and earlier, JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.223 a...

Symantec Altiris Deployment Solution ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Symantec Altiris Deployment Solution. When sending an overly long string to RunCmd method of AeXNSConsoleUtilities.dll 6.0.0.1426 an attacker may be able to execute arbitrary code. Module Options msf use...

Hewlett-Packard Power Manager Administration Buffer Overflow

This module exploits a stack buffer overflow in Hewlett-Packard Power Manager 4.2. Sending a specially crafted POST request with an overly long Login string, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/powermanagerlogin msf...

Sun Java JRE AWT setDiffICM Buffer Overflow

This module exploits a flaw in the setDiffICM function in the Sun JVM. The payload is serialized and passed to the applet via PARAM tags. It must be a native payload. The effected Java versions are JDK and JRE 6 Update 16 and earlier, JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.223 and...

IBM Tivoli Storage Manager Express RCA Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express Remote Client Agent service. By sending a "dicuGetIdentify" request packet containing a long NodeName parameter, an attacker can execute arbitrary code. NOTE: this exploit first connects to the CAD service to...

IBM Tivoli Storage Manager Express CAD Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service. By sending a "ping" packet containing a long string, an attacker can execute arbitrary code. NOTE: the dsmcad.exe service must be in a particular state CadWaitingStatus = 1 in order for the...

CA eTrust PestPatrol ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in CA eTrust PestPatrol. When sending an overly long string to the Initialize property of ppctl.dll 5.6.7.9 an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/fileformat/etrust/pestscan msf undefinedpestscan show...

Symantec ConsoleUtilities ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Symantecs ConsoleUtilities. By sending an overly long string to the "BrowseAndSaveFile" method located in the AeXNSConsoleUtilities.dll 6.0.0.1846 Control, an attacker may be able to execute arbitrary code Module Options msf use...

PHP IRC Bot pbot eval() Remote Code Execution

This module allows remote command execution on the PHP IRC bot pbot by abusing the usage of eval in the implementation of the .php command. In order to work, the data to connect to the IRC server and channel where find pbot must be provided. The module has been successfully tested on the version ...

Rhinosoft Serv-U Session Cookie Buffer Overflow

This module exploits a buffer overflow in Rhinosoft Serv-U 9.0.0.5. Sending a specially crafted POST request with an overly long session cookie string, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/servu/sessioncookie msf undefinedsessioncookie sho...

Rogue Gateway Detection: Sender

This module send a series of TCP SYN and ICMP ECHO requests to each internal target host, spoofing the source address of an external system running the roguerecv module. This allows the system running the roguerecv module to determine what external IP a given internal system is using as its defau...

Rogue Gateway Detection: Receiver

This module listens for replies to the requests sent by the roguesend module. The RPORT, CPORT, and ECHOID values must match the roguesend parameters used exactly. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

NETGEAR TelnetEnable

This module sends a magic packet to a NETGEAR device to enable telnetd. Upon successful connect, a root shell should be presented to the user. Module Options msf use exploit/linux/telnet/netgear/telnetenable msf undefinedtelnetenable show actions ...actions... msf undefinedtelnetenable set ACTION...

SafeNet SoftRemote GROUPNAME Buffer Overflow

This module exploits a stack buffer overflow in SafeNet SoftRemote Security Policy Editor use exploit/windows/fileformat/safenet/softremotegroupname msf undefinedsoftremotegroupname show actions ...actions... msf undefinedsoftremotegroupname set ACTION msf undefinedsoftremotegroupname show option...

HTTP GET Request URI Fuzzer (Fuzzer Strings)

This module sends a series of HTTP GET request with malicious URIs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP GET Request URI Fuzzer Fuzzer Strings', 'Description' = %q This module...

HTTP GET Request URI Fuzzer (Incrementing Lengths)

This module sends a series of HTTP GET request with incrementing URL lengths. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP GET Request URI Fuzzer Incrementing Lengths', 'Description' = ...

UFO: Alien Invasion IRC Client Buffer Overflow

This module exploits a buffer overflow in the IRC client component of UFO: Alien Invasion 2.2.1. Module Options msf use exploit/osx/misc/ufo/ai msf undefinedai show actions ...actions... msf undefinedai set ACTION msf undefinedai show options ...show and set options... msf undefinedai run This...

UFO: Alien Invasion IRC Client Buffer Overflow

This module exploits a buffer overflow in the IRC client component of UFO: Alien Invasion 2.2.1. Module Options msf use exploit/windows/misc/ufo/ai msf undefinedai show actions ...actions... msf undefinedai set ACTION msf undefinedai show options ...show and set options... msf undefinedai run Thi...

SMB Create Pipe Request Corruption

This module sends a series of SMB create pipe requests with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Create Pipe Request Corruption', 'Description' = %q This module...

SMB NTLMv1 Login Request Corruption

This module sends a series of SMB login requests using the NTLMv1 protocol with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB NTLMv1 Login Request Corruption',...

SMB Tree Connect Request Corruption

This module sends a series of SMB tree connect requests with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Tree Connect Request Corruption', 'Description' = %q This modul...

SMB Tree Connect Request Fuzzer

This module sends a series of SMB tree connect requests using malicious strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Tree Connect Request Fuzzer', 'Description' = %q This module...

SMB Negotiate Dialect Corruption

This module sends a series of SMB negotiate requests with corrupted bytes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Negotiate Dialect Corruption', 'Description' = %q This module sends...

SMB Create Pipe Request Fuzzer

This module sends a series of SMB create pipe requests using malicious strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Create Pipe Request Fuzzer', 'Description' = %q This module...

SSH Key Exchange Init Corruption

This module sends a series of SSH requests with a corrupted initial key exchange payload. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH Key Exchange Init Corruption', 'Description' = %q...

SSH Version Corruption

This module sends a series of SSH requests with a corrupted version string This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH Version Corruption', 'Description' = %q This module sends a series...

SSH 1.5 Version Fuzzer

This module sends a series of SSH requests with malicious version strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH 1.5 Version Fuzzer', 'Description' = %q This module sends a series...

SMB Negotiate SMB2 Dialect Corruption

This module sends a series of SMB negotiate requests that advertise a SMB2 dialect with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Negotiate SMB2 Dialect Corruption',...

SSH 2.0 Version Fuzzer

This module sends a series of SSH requests with malicious version strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH 2.0 Version Fuzzer', 'Description' = %q This module sends a series...

TDS Protocol Login Request Username Fuzzer

This module sends a series of malformed TDS login requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TDS Protocol Login Request Username Fuzzer', 'Description' = %q This module sends a...

TDS Protocol Login Request Corruption Fuzzer

This module sends a series of malformed TDS login requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TDS Protocol Login Request Corruption Fuzzer', 'Description' = %q This module sends a...

Eureka Email 2.2q ERR Remote Buffer Overflow

This module exploits a buffer overflow in the Eureka Email 2.2q client that is triggered through an excessively long ERR message. NOTE: this exploit isn't very reliable. Unfortunately reaching the vulnerable code can only be done when manually checking mail Ctrl-M. Checking at startup will not...

Java JSP Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1593 include Msf::Payload::Single include Msf::Payload::JSP include...

Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow

This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long AUTHSESSKEY value to the TNS service, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/oracle/tns/authsesskey msf undefinedauthsesskey show...

Search Engine Domain Email Address Collector

This module uses Google, Bing and Yahoo to create a list of valid email addresses for the target domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' class MetasploitModule 'Search Engine Domain...