Microsoft SQL Server Configuration Enumerator

This module will perform a series of configuration audits and security checks against a Microsoft SQL Server database. For this module to work, valid administrative user credentials must be supplied. This module requires Metasploit: https://metasploit.com/download Current source:...

Adobe U3D CLODProgressiveMeshDeclaration Array Overrun

This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include use exploit/multi/fileformat/adobe/u3dmeshcont msf undefinedu3dmeshcont show actions ...actions... msf undefinedu3dmeshcont set ACTION msf undefinedu3dmeshcont show options ...show and set options...

Adobe U3D CLODProgressiveMeshDeclaration Array Overrun

This module exploits an array overflow in Adobe Reader and Adobe Acrobat. Affected versions include use exploit/windows/fileformat/adobe/u3dmeshdecl msf undefinedu3dmeshdecl show actions ...actions... msf undefinedu3dmeshdecl set ACTION msf undefinedu3dmeshdecl show options ...show and set...

Adobe FlateDecode Stream Predictor 02 Integer Overflow

This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions before 9.2. Module Options msf use exploit/windows/browser/adobe/flatedecodepredictor02 msf undefinedflatedecodepredictor02 show actions ...actions... msf undefinedflatedecodepredictor02...

HTTPDX h_handlepeer() Function Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The vulnerability is caused due to a boundary error within the "hhandlepeer" function in http.cpp. By sending an overly long HTTP request, an attacker can overrun a buffer and execute arbitrary code. Modul...

Adobe FlateDecode Stream Predictor 02 Integer Overflow

This module exploits an integer overflow vulnerability in Adobe Reader and Adobe Acrobat Professional versions before 9.2. Module Options msf use exploit/windows/fileformat/adobe/flatedecodepredictor02 msf undefinedflatedecodepredictor02 show actions ...actions... msf...

AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow

This module exploits a buffer overflow vulnerability in opcode 21 handled by rpc.cmsd on AIX. By making a request with a long string passed to the first argument of the "rtablecreate" RPC, a stack based buffer overflow occurs. This leads to arbitrary code execution. NOTE: Unsuccessful attempts ma...

Dopewars Denial of Service

The jet command in Dopewars 1.5.12 is vulnerable to a segmentation fault due to a lack of input validation. Module Options msf use auxiliary/dos/misc/dopewars msf undefineddopewars show actions ...actions... msf undefineddopewars set ACTION msf undefineddopewars show options ...show and set...

NTP.org ntpd Reserved Mode Denial of Service

This module exploits a denial of service vulnerability within the NTP network time protocol demon. By sending a single packet to a vulnerable ntpd server Victim A, spoofed from the IP address of another vulnerable ntpd server Victim B, both victims will enter an infinite response loop. Note, unle...

Xlink FTP Server Buffer Overflow

This module exploits a stack buffer overflow in Xlink FTP Server that comes bundled with Omni-NFS Enterprise 5.2. When a overly long FTP request is sent to the server, arbitrary code may be executed. Module Options msf use exploit/windows/ftp/xlink/server msf undefinedserver show actions...

Xlink FTP Client Buffer Overflow

This module exploits a stack buffer overflow in Xlink FTP Client 32 Version 3.01 that comes bundled with Omni-NFS Enterprise 5.2. When an overly long FTP server response is received by a client, arbitrary code may be executed. Module Options msf use exploit/windows/ftp/xlink/client msf...

Oracle Database Enumeration

This module provides a simple way to scan an Oracle database server for configuration parameters that may be useful during a penetration test. Valid database credentials must be provided for this module to run. This module requires Metasploit: https://metasploit.com/download Current source:...

NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow

This module exploits a stack buffer overflow in the NetWare PKERNEL.NLM driver's CALLIT procedure. PKERNEL.NLM is installed by default on all NetWare servers to support NFS. The PKERNEL.NLM module runs in kernel mode so a failed exploit attempt can cause the operating system to reboot. Module...

EMC ApplicationXtender (KeyWorks) ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the KeyWorks KeyHelp ActiveX Control KeyHelp.ocx 1.2.3120.0. This ActiveX Control comes bundled with EMC's Documentation ApplicationXtender 5.4. Module Options msf use exploit/windows/fileformat/emc/appextenderkeyworks msf undefinedappextenderkeywor...

Persits XUpload ActiveX MakeHttpRequest Directory Traversal

This module exploits a directory traversal in Persits Software Inc's XUpload ActiveX controlversion 3.0.0.3 that's included in HP LoadRunner 9.5. By passing a string containing ".." sequences to the MakeHttpRequest method, an attacker is able to write arbitrary files to arbitrary locations on...

InterSystems Cache UtilConfigHome.csp Argument Buffer Overflow

This module exploits a stack buffer overflow in InterSystems Cache 2009.1. By sending a specially crafted GET request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/intersystems/cache msf undefinedcache show actions ...actions... msf undefinedcache...

WinRAR Filename Spoofing

This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from the central directory, but the file names used to extract and open contents come from the Local File Header. This...

Java JSP Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 1501 include Msf::Payload::Single include Msf::Payload::JSP include...

Windows Meterpreter (Reflective Injection), Reverse All-Port TCP Stager

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Upload/Execute, Reverse All-Port TCP Stager

Uploads an executable and runs it staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

Reflective DLL Injection, Reverse All-Port TCP Stager

Inject a DLL via a reflective loader. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

Windows Meterpreter (skape/jt Injection), Reverse All-Port TCP Stager

Inject the meterpreter server DLL staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

Windows Command Shell, Reverse All-Port TCP Stager

Spawn a piped command shell staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 include...

VNC Server (Reflective Injection), Reverse All-Port TCP Stager

Inject a VNC Dll via a reflective loader staged. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282...

Windows Inject DLL, Reverse All-Port TCP Stager

Inject a custom DLL into the exploited process. Try to connect back to the attacker, on all possible ports 1-65535, slowly This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 282 inclu...

Motorola Timbuktu Service Detection

This module simply sends a packet to the Motorola Timbuktu service for detection. Module Options msf use auxiliary/scanner/motorola/timbuktu/udp msf undefinedudp show actions ...actions... msf undefinedudp set ACTION msf undefinedudp show options ...show and set options... msf undefinedudp run Th...

Vermillion FTP Daemon PORT Command Memory Corruption

This module exploits an out-of-bounds array access in the Arcane Software Vermillion FTP server. By sending a specially crafted FTP PORT command, an attacker can corrupt stack memory and execute arbitrary code. This particular issue is caused by processing data bound by attacker controlled input...

Adobe RoboHelp Server 8 Arbitrary File Upload and Execute

This module exploits an authentication bypass vulnerability which allows remote attackers to upload and execute arbitrary code. Module Options msf use exploit/windows/http/adobe/robohelperauthbypass msf undefinedrobohelperauthbypass show actions ...actions... msf undefinedrobohelperauthbypass set...

NFS Mount Scanner

This module scans NFS mounts and their permissions. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NFS Mount Scanner', 'Description' = %q This module scans NFS mounts and their permissions. ,...

pSnuffle Packet Sniffer

This module sniffs passwords like dsniff did in the past This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework dsniff was helping me very often. Too bad that it doesn't work correctly anymore. Psnuffle should bring password...

DECT Call Scanner

This module scans for active DECT calls This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DECT Call Scanner', 'Description' = 'This module scans for active DECT calls', 'Author' = 'DK ' , 'Licens...

DECT Base Station Scanner

This module scans for DECT base stations This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DECT Base Station Scanner', 'Description' = 'This module scans for DECT base stations', 'Author' = 'DK '...

Zabbix Agent net.tcp.listen Command Injection

This module exploits a metacharacter injection vulnerability in the FreeBSD and Solaris versions of the Zabbix agent. This flaw can only be exploited if the attacker can hijack the IP address of an authorized server as defined in the configuration file. Module Options msf use...

Zabbix Server Arbitrary Command Execution

This module abuses the "Command" trap in Zabbix Server to execute arbitrary commands without authentication. By default the Node ID "0" is used, if it doesn't work, the Node ID is leaked from the error message and exploitation retried. According to the vendor versions prior to 1.6.9 are vulnerabl...

SMB 2.0 Protocol Detection

Detect systems that support the SMB 2.0 protocol...

Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute

This module allows remote attackers to install and execute arbitrary files on a users file system via AeXNSPkgDLLib.dll 6.0.0.1418. This module was tested against Symantec Altiris Deployment Solution 6.9 sp3. Module Options msf use...

MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference

This module exploits an out of bounds function table dereference in the SMB request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7 release candidates not RTM, and Windows 2008 Server prior to R2. Windows Vista without SP1 does not seem affected by this flaw. Module...

Microsoft IIS FTP Server LIST Stack Exhaustion

This module triggers Denial of Service condition in the Microsoft Internet Information Services IIS FTP Server 5.0 through 7.0 via a list ls -R command containing a wildcard. For this exploit to work in most cases, you need 1 a valid ftp account: either read-only or write-access account 2 the "FT...

MS09-053 Microsoft IIS FTP Server NLST Response Overflow

This module exploits a stack buffer overflow flaw in the Microsoft IIS FTP service. The flaw is triggered when a special NLST argument is passed while the session has changed into a long directory path. For this exploit to work, the FTP server must be configured to allow write access to the file...

osCommerce 2.2 Arbitrary PHP Code Execution

osCommerce is a popular open source E-Commerce application. The admin console contains a file management utility that allows administrators to upload, download, and edit files. This could be abused to allow unauthenticated attackers to execute arbitrary code with the permissions of the webserver...

DCERPC TCP Service Auditor

Determine what DCERPC services are accessible over a TCP port This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DCERPC TCP Service Auditor', 'Description' = 'Determine what DCERPC services are...

Oracle Document Capture 10g ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Oracle Document Capture 10g 10.1.3.5.0. Oracle Document Capture 10g comes bundled with a third party ActiveX control emsmtp.dll 6.0.1.0. When passing an overly long string to the method "SubmitToExpress" an attacker may be able to execute arbitrary...

Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Windows x64 Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 505 include Msf::Payload::Windows include Msf::Payload::Single include...

Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager

Inject a VNC Dll via a reflective loader Windows x64 staged. Connect back to the attacker Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 449 include Msf::Payload::Stag...

Windows x64 Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 460 include Msf::Payload::Windows include Msf::Payload::Single includ...

Windows x64 Command Shell, Windows x64 Bind TCP Stager

Spawn a piped command shell Windows x64 staged. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 483 include Msf::Payload::Stager include...

Windows x64 Command Shell, Windows x64 Reverse TCP Stager

Spawn a piped command shell Windows x64 staged. Connect back to the attacker Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 449 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager

Inject a VNC Dll via a reflective loader Windows x64 staged. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 483 include Msf::Payload::Stager...