Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 183 include Msf::Payload::Single include Msf::Payload::Linux::Ppc::Prepends inclu...

Linux Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 223 include Msf::Payload::Single include Msf::Payload::Linux::Ppc::Prepends includ...

Linux Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 171 include Msf::Payload::Single include Msf::Payload::Linux::Ppc::Prepends include...

Linux Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 223 include Msf::Payload::Single include Msf::Payload::Linux::Ppc::Prepends includ...

Linux Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 171 include Msf::Payload::Single include Msf::Payload::Linux::Ppc::Prepends include...

IBM DB2 db2rcmd.exe Command Execution Vulnerability

This module exploits a vulnerability in the Remote Command Server component in IBM's DB2 Universal Database 8.1. An authenticated attacker can send arbitrary commands to the DB2REMOTECMD named pipe which could lead to administrator privileges. This module requires Metasploit:...

Microsoft Vista SP0 SMB Negotiate Protocol DoS

This module exploits a flaw in Windows Vista that allows a remote unauthenticated attacker to disable the SMB service. This vulnerability was silently fixed in Microsoft Vista Service Pack 1. This module requires Metasploit: https://metasploit.com/download Current source:...

BEA Weblogic Transfer-Encoding Buffer Overflow

This module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. This vulnerability exists in the error reporting for unknown Transfer-Encoding headers. You may have to run this twice due to timing issues with handlers. This module requires Metasploit:...

MS06-013 Microsoft Internet Explorer createTextRange() Code Execution

This module exploits a code execution vulnerability in Microsoft Internet Explorer. Both IE6 and IE7 Beta 2 are vulnerable. It will corrupt memory in a way, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point to a very remote, non-existent...

PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)

This module exploits an integer overflow vulnerability in the unserialize function of the PHP web server extension. This vulnerability was patched by Stefan in version 4.5.0 and applies all previous versions supporting this function. This particular module targets numerous web applications and is...

MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability

This module exploits a heap overflow vulnerability in the KeyFrame method of the direct animation ActiveX control. This is a port of the exploit implemented by Alexander Sotirov. This module requires Metasploit: https://metasploit.com/download Current source:...

Zenturi ProgramChecker ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system via the Zenturi ProgramChecker sasatl.dll 1.5.0.531 ActiveX Control. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Ruby WEBrick::HTTP::DefaultFileHandler DoS

The WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 to 1.8.6-p286, 1.8.7 to 1.8.7-p71, and 1.9 to r18423 allows for a DoS CPU consumption via a crafted HTTP request. This module requires Metasploit: https://metasploit.com/download Current source:...

Microsoft Host Integration Server 2006 Command Execution Vulnerability

This module exploits a command-injection vulnerability in Microsoft Host Integration Server 2006. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Host Integration Server 2006 Command...

Quick FTP Pro 2.1 Transfer-Mode Overflow

This module exploits a stack buffer overflow in the Quick TFTP Pro server product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting in a DoS. This is a port of a sploit by Mati "muts" Aharoni. This module requires Metasploit: https://metasploit.com/download Curre...

Husdawg, LLC. System Requirements Lab ActiveX Unsafe Method

This module allows attackers to execute code via an unsafe method in Husdawg, LLC. System Requirements Lab ActiveX Control sysreqlab2.dll 2.30.0.0 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Sun Solaris sadmind adm_build_path() Buffer Overflow

This module exploits a buffer overflow vulnerability in admbuildpath function of sadmind daemon. The distributed system administration daemon sadmind is the daemon used by Solstice AdminSuite applications to perform distributed system administration operations. The sadmind daemon is started...

iseemedia / Roxio / MGI Software LPViewer ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in LPViewer ActiveX control LPControll.dll 3.2.0.2. When sending an overly long string to the URL property an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

SoftArtisans XFile FileManager ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SoftArtisans XFile FileManager ActiveX control SAFmgPwd.dll 2.0.5.3. When sending an overly long string to the GetDriveName method an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download...

Generic PHP Code Evaluation

Exploits things like It is likely that HTTP evasion options will break this exploit. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Generic PHP Code Evaluation', 'Description' = %q Exploits...

EMC AlphaStor Library Manager Arbitrary Command Execution

EMC AlphaStor Library Manager is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

EMC AlphaStor Library Manager Service

This module queries the remote host for the EMC Alphastor Library Management Service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'EMC AlphaStor Library Manager Service', 'Description' = 'Th...

HTTP Microsoft SQL Injection Table XSS Infection

This module implements the mass SQL injection attack in use lately by concatenation of HTML string that forces a persistent XSS attack to redirect user browser to an attacker controller website. This module requires Metasploit: https://metasploit.com/download Current source:...

EMC AlphaStor Device Manager Service

This module queries the remote host for the EMC Alphastor Device Management Service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'EMC AlphaStor Device Manager Service', 'Description' = 'This...

Medal of Honor Allied Assault getinfo Stack Buffer Overflow

This module exploits a stack based buffer overflow in the getinfo command of Medal Of Honor Allied Assault. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Medal of Honor Allied Assault getinfo...

Motorola WR850G v4.03 Credentials

Login credentials to the Motorola WR850G router with firmware v4.03 can be obtained via a simple GET request if issued while the administrator is logged in. A lot more information is available through this request, but you can get it all and more after logging in. This module requires Metasploit:...

Authentication Capture: Telnet

This module provides a fake Telnet service that is designed to capture authentication credentials. DONTs and WONTs are sent to the client for all option negotiations, except for ECHO at the time of the password prompt since the server controls that for a bit more realism. This module requires...

Macrovision InstallShield Update Service ActiveX Unsafe Method

This module allows attackers to execute code via an unsafe method in Macrovision InstallShield 2008. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Macrovision InstallShield Update Service...

Mercury/32 4.01 IMAP LOGIN SEH Buffer Overflow

This module exploits a stack buffer overflow in Mercury/32 'Mercury/32 4.01 IMAP LOGIN SEH Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in Mercury/32 'mu-b', Discovery and exploit 'MC', Metasploit module 'Ivan Racic' Automatic targeting + egg hunter , 'License...

McAfee ePolicy Orchestrator / ProtectionPilot Overflow

This is an exploit for the McAfee HTTP Server NAISERV.exe. McAfee ePolicy Orchestrator 2.5.1 'McAfee ePolicy Orchestrator / ProtectionPilot Overflow', 'Description' = %q This is an exploit for the McAfee HTTP Server NAISERV.exe. McAfee ePolicy Orchestrator 2.5.1 'muts ', 'xbxiceatyahoo.com', 'hdm...

MS03-020 Microsoft Internet Explorer Object Type

This module exploits a vulnerability in Internet Explorer's handling of the OBJECT type attribute. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MS03-020 Microsoft Internet Explorer Object...

Windows Media Encoder 9 wmex.dll ActiveX Buffer Overflow

This module exploits a stack buffer overflow in Windows Media Encoder 9. When sending an overly long string to the GetDetailsString method of wmex.dll an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system via the Microsoft Office Snapshot Viewer ActiveX Control. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Windows Command Shell, Bind TCP Stager (Windows x86)

Spawn a piped command shell staged. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Inject DLL, Bind TCP Stager (Windows x86)

Inject a custom DLL into the exploited process. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Bind TCP Stager (Windows x86)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Windows Meterpreter (skape/jt Injection), Bind TCP Stager (Windows x86)

Inject the meterpreter server DLL staged. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Upload/Execute, Bind TCP Stager (Windows x86)

Uploads an executable and runs it staged. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Reflective DLL Injection, Bind TCP Stager (Windows x86)

Inject a DLL via a reflective loader. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

VNC Server (Reflective Injection), Bind TCP Stager (Windows x86)

Inject a VNC Dll via a reflective loader staged. Listen for a connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

WinFTP 2.3.0 NLST Denial of Service

This module is a very rough port of Julien Bedard's PoC. You need a valid login, but even anonymous can do it if it has permission to call NLST. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

DATAC RealWin SCADA Server Buffer Overflow

This module exploits a stack buffer overflow in DATAC Control International RealWin SCADA Server 2.0 Build 6.0.10.37. By sending a specially crafted FCINFOTAG/SETCONTROL packet, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download...

PHP Command Shell, Find Sock

Spawn a shell on the established connection to the webserver. Unfortunately, this payload can leave conspicuous evil-looking entries in the apache error logs, so it is probably a good idea to use a bind or reverse shell unless firewalls prevent them from working. The issue this payload takes...

Generic x86 Debug Trap

Generate a debug trap in the target process This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo, 'Name' = 'Generi...

Linksys WRT54 Access Point apply.cgi Buffer Overflow

This module exploits a stack buffer overflow in apply.cgi on the Linksys WRT54G and WRT54GS routers. According to iDefense who discovered this vulnerability, all WRT54G versions prior to 4.20.7 and all WRT54GS version prior to 1.05.2 may be affected. This module requires Metasploit:...

Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 184 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

XOR Encoder

Mips Web server exploit friendly xor encoder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'XOR Encoder', 'Description' = %q Mips Web server exploit friendly xor encoder ,...

Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 184 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

XOR Encoder

Mips Web server exploit friendly xor encoder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'XOR Encoder', 'Description' = %q Mips Web server exploit friendly xor encoder ,...

EMC AlphaStor Agent Buffer Overflow

This module exploits a stack buffer overflow in EMC AlphaStor 3.1. By sending a specially crafted message, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...