SMB Tree Connect Request Fuzzer

This module sends a series of SMB tree connect requests using malicious strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Tree Connect Request Fuzzer', 'Description' = %q This module...

SMB NTLMv1 Login Request Corruption

This module sends a series of SMB login requests using the NTLMv1 protocol with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB NTLMv1 Login Request Corruption',...

SMB Negotiate Dialect Corruption

This module sends a series of SMB negotiate requests with corrupted bytes This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Negotiate Dialect Corruption', 'Description' = %q This module sends...

SMB Create Pipe Request Corruption

This module sends a series of SMB create pipe requests with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Create Pipe Request Corruption', 'Description' = %q This module...

SMB Create Pipe Request Fuzzer

This module sends a series of SMB create pipe requests using malicious strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Create Pipe Request Fuzzer', 'Description' = %q This module...

SSH Key Exchange Init Corruption

This module sends a series of SSH requests with a corrupted initial key exchange payload. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH Key Exchange Init Corruption', 'Description' = %q...

SMB Negotiate SMB2 Dialect Corruption

This module sends a series of SMB negotiate requests that advertise a SMB2 dialect with corrupted bytes. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Negotiate SMB2 Dialect Corruption',...

SSH 1.5 Version Fuzzer

This module sends a series of SSH requests with malicious version strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH 1.5 Version Fuzzer', 'Description' = %q This module sends a series...

SSH Version Corruption

This module sends a series of SSH requests with a corrupted version string This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH Version Corruption', 'Description' = %q This module sends a series...

SSH 2.0 Version Fuzzer

This module sends a series of SSH requests with malicious version strings. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSH 2.0 Version Fuzzer', 'Description' = %q This module sends a series...

TDS Protocol Login Request Username Fuzzer

This module sends a series of malformed TDS login requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TDS Protocol Login Request Username Fuzzer', 'Description' = %q This module sends a...

TDS Protocol Login Request Corruption Fuzzer

This module sends a series of malformed TDS login requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TDS Protocol Login Request Corruption Fuzzer', 'Description' = %q This module sends a...

Eureka Email 2.2q ERR Remote Buffer Overflow

This module exploits a buffer overflow in the Eureka Email 2.2q client that is triggered through an excessively long ERR message. NOTE: this exploit isn't very reliable. Unfortunately reaching the vulnerable code can only be done when manually checking mail Ctrl-M. Checking at startup will not...

Java JSP Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1593 include Msf::Payload::Single include Msf::Payload::JSP include...

Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow

This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long AUTHSESSKEY value to the TNS service, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/oracle/tns/authsesskey msf undefinedauthsesskey show...

Search Engine Domain Email Address Collector

This module uses Google, Bing and Yahoo to create a list of valid email addresses for the target domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' class MetasploitModule 'Search Engine Domain...

Microsoft SQL Server Configuration Enumerator

This module will perform a series of configuration audits and security checks against a Microsoft SQL Server database. For this module to work, valid administrative user credentials must be supplied. This module requires Metasploit: https://metasploit.com/download Current source:...

Adobe U3D CLODProgressiveMeshDeclaration Array Overrun

This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include use exploit/windows/fileformat/adobe/u3dmeshdecl msf undefinedu3dmeshdecl show actions ...actions... msf undefinedu3dmeshdecl set ACTION msf undefinedu3dmeshdecl show options ...show and set...

Adobe U3D CLODProgressiveMeshDeclaration Array Overrun

This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include use exploit/multi/fileformat/adobe/u3dmeshcont msf undefinedu3dmeshcont show actions ...actions... msf undefinedu3dmeshcont set ACTION msf undefinedu3dmeshcont show options ...show and set options...

HTTPDX h_handlepeer() Function Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The vulnerability is caused due to a boundary error within the "hhandlepeer" function in http.cpp. By sending an overly long HTTP request, an attacker can overrun a buffer and execute arbitrary code. Modul...

Adobe FlateDecode Stream Predictor 02 Integer Overflow

This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions before 9.2. Module Options msf use exploit/windows/fileformat/adobe/flatedecodepredictor02 msf undefinedflatedecodepredictor02 show actions ...actions... msf...

Adobe FlateDecode Stream Predictor 02 Integer Overflow

This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions before 9.2. Module Options msf use exploit/windows/browser/adobe/flatedecodepredictor02 msf undefinedflatedecodepredictor02 show actions ...actions... msf undefinedflatedecodepredictor02...

AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow

This module exploits a buffer overflow vulnerability in opcode 21 handled by rpc.cmsd on AIX. By making a request with a long string passed to the first argument of the "rtablecreate" RPC, a stack based buffer overflow occurs. This leads to arbitrary code execution. NOTE: Unsuccessful attempts ma...

Dopewars Denial of Service

The jet command in Dopewars 1.5.12 is vulnerable to a segmentation fault due to a lack of input validation. Module Options msf use auxiliary/dos/misc/dopewars msf undefineddopewars show actions ...actions... msf undefineddopewars set ACTION msf undefineddopewars show options ...show and set...

NTP.org ntpd Reserved Mode Denial of Service

This module exploits a denial of service vulnerability within the NTP network time protocol demon. By sending a single packet to a vulnerable ntpd server Victim A, spoofed from the IP address of another vulnerable ntpd server Victim B, both victims will enter an infinite response loop. Note, unle...

Xlink FTP Client Buffer Overflow

This module exploits a stack buffer overflow in Xlink FTP Client 32 Version 3.01 that comes bundled with Omni-NFS Enterprise 5.2. When an overly long FTP server response is received by a client, arbitrary code may be executed. Module Options msf use exploit/windows/ftp/xlink/client msf...

Xlink FTP Server Buffer Overflow

This module exploits a stack buffer overflow in Xlink FTP Server that comes bundled with Omni-NFS Enterprise 5.2. When a overly long FTP request is sent to the server, arbitrary code may be executed. Module Options msf use exploit/windows/ftp/xlink/server msf undefinedserver show actions...

Oracle Database Enumeration

This module provides a simple way to scan an Oracle database server for configuration parameters that may be useful during a penetration test. Valid database credentials must be provided for this module to run. This module requires Metasploit: https://metasploit.com/download Current source:...

NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow

This module exploits a stack buffer overflow in the NetWare PKERNEL.NLM driver's CALLIT procedure. PKERNEL.NLM is installed by default on all NetWare servers to support NFS. The PKERNEL.NLM module runs in kernel mode so a failed exploit attempt can cause the operating system to reboot. Module...

Persits XUpload ActiveX MakeHttpRequest Directory Traversal

This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX controlversion 3.0.0.3 that's included in HP LoadRunner 9.5. By passing a string containing ".." sequences to the MakeHttpRequest method, an attacker is able to write arbitrary files to arbitrary locations on...

InterSystems Cache UtilConfigHome.csp Argument Buffer Overflow

This module exploits a stack buffer overflow in InterSystems Cache 2009.1. By sending a specially crafted GET request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/intersystems/cache msf undefinedcache show actions ...actions... msf undefinedcache...

EMC ApplicationXtender (KeyWorks) ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the KeyWorks KeyHelp ActiveX Control KeyHelp.ocx 1.2.3120.0. This ActiveX Control comes bundled with EMC's Documentation ApplicationXtender 5.4. Module Options msf use exploit/windows/fileformat/emc/appextenderkeyworks msf undefinedappextenderkeywor...

WinRAR Filename Spoofing

This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from the central directory, but the file names used to extract and open contents come from the Local File Header. This...

Java JSP Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1501 include Msf::Payload::Single include Msf::Payload::JSP include...

Windows Inject DLL, Reverse All-Port TCP Stager

Inject a custom DLL into the exploited process. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 inclu...

Windows Meterpreter (skape/jt Injection), Reverse All-Port TCP Stager

Inject the meterpreter server DLL staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

Reflective DLL Injection, Reverse All-Port TCP Stager

Inject a DLL via a reflective loader. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

Windows Upload/Execute, Reverse All-Port TCP Stager

Uploads an executable and runs it staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

Windows Command Shell, Reverse All-Port TCP Stager

Spawn a piped command shell staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

VNC Server (Reflective Injection), Reverse All-Port TCP Stager

Inject a VNC Dll via a reflective loader staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282...

Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source:...

Motorola Timbuktu Service Detection

This module simply sends a packet to the Motorola Timbuktu service for detection. Module Options msf use auxiliary/scanner/motorola/timbuktu/udp msf undefinedudp show actions ...actions... msf undefinedudp set ACTION msf undefinedudp show options ...show and set options... msf undefinedudp run Th...

Vermillion FTP Daemon PORT Command Memory Corruption

This module exploits an out-of-bounds array access in the Arcane Software Vermillion FTP server. By sending a specially crafted FTP PORT command, an attacker can corrupt stack memory and execute arbitrary code. This particular issue is caused by processing data bound by attacker controlled input...

Adobe RoboHelp Server 8 Arbitrary File Upload and Execute

This module exploits an authentication bypass vulnerability which allows remote attackers to upload and execute arbitrary code. Module Options msf use exploit/windows/http/adobe/robohelperauthbypass msf undefinedrobohelperauthbypass show actions ...actions... msf undefinedrobohelperauthbypass set...

NFS Mount Scanner

This module scans NFS mounts and their permissions. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NFS Mount Scanner', 'Description' = %q This module scans NFS mounts and their permissions. ,...

pSnuffle Packet Sniffer

This module sniffs passwords like dsniff did in the past This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework dsniff was helping me very often. Too bad that it doesn't work correctly anymore. Psnuffle should bring password...

DECT Base Station Scanner

This module scans for DECT base stations This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DECT Base Station Scanner', 'Description' = 'This module scans for DECT base stations', 'Author' = 'DK '...

DECT Call Scanner

This module scans for active DECT calls This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DECT Call Scanner', 'Description' = 'This module scans for active DECT calls', 'Author' = 'DK ' , 'Licens...

Zabbix Server Arbitrary Command Execution

This module abuses the "Command" trap in Zabbix Server to execute arbitrary commands without authentication. By default the Node ID "0" is used, if it doesn't work, the Node ID is leaked from the error message and exploitation retried. According to the vendor versions prior to 1.6.9 are vulnerabl...

Zabbix Agent net.tcp.listen Command Injection

This module exploits a metacharacter injection vulnerability in the FreeBSD and Solaris versions of the Zabbix agent. This flaw can only be exploited if the attacker can hijack the IP address of an authorized server as defined in the configuration file. Module Options msf use...