SMB 2.0 Protocol Detection

Detect systems that support the SMB 2.0 protocol...

Symantec Altiris Deployment Solution ActiveX Control Arbitrary File Download and Execute

This module allows remote attackers to install and execute arbitrary files on a users file system via AeXNSPkgDLLib.dll 6.0.0.1418. This module was tested against Symantec Altiris Deployment Solution 6.9 sp3. Module Options msf use...

MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference

This module exploits an out of bounds function table dereference in the SMB request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7 release candidates not RTM, and Windows 2008 Server prior to R2. Windows Vista without SP1 does not seem affected by this flaw. Module...

Microsoft IIS FTP Server LIST Stack Exhaustion

This module triggers Denial of Service condition in the Microsoft Internet Information Services IIS FTP Server 5.0 through 7.0 via a list ls -R command containing a wildcard. For this exploit to work in most cases, you need 1 a valid ftp account: either read-only or write-access account 2 the "FT...

MS09-053 Microsoft IIS FTP Server NLST Response Overflow

This module exploits a stack buffer overflow flaw in the Microsoft IIS FTP service. The flaw is triggered when a special NLST argument is passed while the session has changed into a long directory path. For this exploit to work, the FTP server must be configured to allow write access to the file...

osCommerce 2.2 Arbitrary PHP Code Execution

osCommerce is a popular open source E-Commerce application. The admin console contains a file management utility that allows administrators to upload, download, and edit files. This could be abused to allow unauthenticated attackers to execute arbitrary code with the permissions of the webserver...

DCERPC TCP Service Auditor

Determine what DCERPC services are accessible over a TCP port This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DCERPC TCP Service Auditor', 'Description' = 'Determine what DCERPC services are...

Oracle Document Capture 10g ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Oracle Document Capture 10g 10.1.3.5.0. Oracle Document Capture 10g comes bundled with a third party ActiveX control emsmtp.dll 6.0.1.0. When passing an overly long string to the method "SubmitToExpress" an attacker may be able to execute arbitrary...

Windows x64 Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 460 include Msf::Payload::Windows include Msf::Payload::Single includ...

Windows x64 VNC Server (Reflective Injection), Windows x64 Reverse TCP Stager

Inject a VNC Dll via a reflective loader Windows x64 staged. Connect back to the attacker Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 449 include Msf::Payload::Stag...

Windows x64 Command Shell, Windows x64 Bind TCP Stager

Spawn a piped command shell Windows x64 staged. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 483 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection x64), Windows x64 Bind TCP Stager

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Windows x64 VNC Server (Reflective Injection), Windows x64 Bind TCP Stager

Inject a VNC Dll via a reflective loader Windows x64 staged. Listen for a connection Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 483 include Msf::Payload::Stager...

Windows x64 Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 505 include Msf::Payload::Windows include Msf::Payload::Single include...

Windows Meterpreter (Reflective Injection x64), Windows x64 Reverse TCP Stager

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Windows x64 Command Shell, Windows x64 Reverse TCP Stager

Spawn a piped command shell Windows x64 staged. Connect back to the attacker Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 449 include Msf::Payload::Stager include...

ProFTP 2.9 Banner Remote Buffer Overflow

This module exploits a buffer overflow in the ProFTP 2.9 client that is triggered through an excessively long welcome message. Module Options msf use exploit/windows/ftp/proftp/banner msf undefinedbanner show actions ...actions... msf undefinedbanner set ACTION msf undefinedbanner show options...

XOR Encoder

An x64 XOR encoder. Uses an 8 byte key and takes advantage of x64 relative addressing. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'XOR Encoder', 'Description' = 'An x64 XOR encoder. Uses an...

Simple

An x64 single/multi byte NOP instruction generator. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Simple', 'Alias' = 'x64simple', 'Description' = 'An x64 single/multi byte NOP instruction...

Windows x64 Execute Command

Execute an arbitrary command Windows x64 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 275 include Msf::Payload::Windows include Msf::Payload::Single def initializeinfo =...

ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in ProShow Gold v4.0.2549. An attacker must send the file to victim and the victim must open the file. Module Options msf use exploit/windows/fileformat/proshow/cellimagebof msf undefinedcellimagebof show actions ...actions... msf...

Xenorate 2.50 (.xpl) Universal Local Buffer Overflow (SEH)

This module exploits a stack buffer overflow in Xenorate 2.50 by creating a specially crafted xpl file. Module Options msf use exploit/windows/fileformat/xenorate/xplbof msf undefinedxplbof show actions ...actions... msf undefinedxplbof set ACTION msf undefinedxplbof show options ...show and set...

VUPlayer M3U Buffer Overflow

This module exploits a stack over flow in VUPlayer use exploit/windows/fileformat/vuplayer/m3u msf undefinedm3u show actions ...actions... msf undefinedm3u set ACTION msf undefinedm3u show options ...show and set options... msf undefinedm3u run This module requires Metasploit:...

Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability

This module exploits an authentication bypass vulnerability in login.php in order to execute arbitrary code via a command injection vulnerability in propertybox.php. This module was tested against Oracle Secure Backup version 10.3.0.1.0 Win32. Module Options msf use...

VUPlayer CUE Buffer Overflow

This module exploits a stack based overflow in VUPlayer use exploit/windows/fileformat/vuplayer/cue msf undefinedcue show actions ...actions... msf undefinedcue set ACTION msf undefinedcue show options ...show and set options... msf undefinedcue run This module requires Metasploit:...

Linux Kernel Sendpage Local Privilege Escalation

The Linux kernel failed to properly initialize some entries in the protoops struct for several protocols, leading to NULL being dereferenced and used as a function pointer. By using mmap2 to map page 0, an attacker can execute arbitrary code in the context of the kernel. Several public exploits...

Microsoft OWC Spreadsheet HTMLURL Buffer Overflow

This module exploits a buffer overflow in Microsoft's Office Web Components. When passing an overly long string as the "HTMLURL" parameter an attacker can execute arbitrary code. Module Options msf use exploit/windows/browser/ms09/043owchtmlurl msf undefined043owchtmlurl show actions ...actions...

DB2 Discovery Service Detection

This module simply queries the DB2 discovery service for information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DB2 Discovery Service Detection', 'Description' = 'This module simply queri...

BlazeDVD 6.1 PLF Buffer Overflow

This module exploits a stack over flow in BlazeDVD 5.1 and 6.2. When the application is used to open a specially crafted plf file, a buffer is overwritten allowing for the execution of arbitrary code. Module Options msf use exploit/windows/fileformat/blazedvd/plf msf undefinedplf show actions...

FreeBSD Meterpreter Service, Reverse TCP Inline

Stub payload for interacting with a Meterpreter Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Bsd include Msf::Payload::Single include...

FreeBSD Meterpreter Service, Bind TCP

Stub payload for interacting with a Meterpreter Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Bsd include Msf::Payload::Single include...

Linux Meterpreter Service, Bind TCP

Stub payload for interacting with a Meterpreter Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Linux::X86::Prepends include Msf::Payload::Single...

Linux Meterpreter Service, Reverse TCP Inline

Stub payload for interacting with a Meterpreter Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Linux::X86::Prepends include Msf::Payload::Single...

SAP Business One License Manager 2005 Buffer Overflow

This module exploits a stack buffer overflow in the SAP Business One 2005 License Manager 'NT Naming Service' A and B releases. By sending an excessively long string the stack is overwritten enabling arbitrary code execution. Module Options msf use exploit/windows/misc/sap/2005license msf...

Millenium MP3 Studio 2.0 (PLS File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in Millenium MP3 Studio 2.0. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an embedded PLS file within a browser, when the PLS extension is registered to...

AIX SNMP Scanner Auxiliary Module

AIX SNMP Scanner Auxiliary Module This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AIX SNMP Scanner Auxiliary Module', 'Description' = 'AIX SNMP Scanner Auxiliary Module', 'Author' = 'Ramon de C...

PHP Executable Download and Execute

Download an EXE from an HTTP URL and execute it This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Php include Msf::Payload::Single def initializeinfo =...

Authentication Capture: HTTP

This module provides a fake HTTP service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: HTTP', 'Description' = %...

FTP File Server

This module provides a FTP service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTP File Server', 'Description' = %q This module provides a FTP service , 'Author' = 'hdm', 'License' =...

Joomla 1.5.12 TinyBrowser File Upload Code Execution

This module exploits a vulnerability in the TinyMCE/tinybrowser plugin. This plugin is not secured in version 1.5.12 of joomla and allows the upload of files on the remote server. By renaming the uploaded file this vulnerability can be used to upload/execute code on the affected system. Module...

Unix Command Shell, Reverse TCP (via netcat)

Creates an interactive shell via netcat This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

Unix Command Shell, Bind TCP (via netcat)

Listen for a connection and spawn a command shell via netcat This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include...

DD-WRT HTTP Daemon Arbitrary Command Execution

This module abuses a metacharacter injection vulnerability in the HTTP management server of wireless gateways running DD-WRT. This flaw allows an unauthenticated attacker to execute arbitrary commands as the root user account. Module Options msf use exploit/linux/http/ddwrt/cgibinexec msf...

Windows Meterpreter Service, Reverse TCP Inline

Stub payload for interacting with a Meterpreter Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Windows include Msf::Payload::Single include...

Firefox 3.5 escape() Return Value Memory Corruption

This module exploits a memory corruption vulnerability in the Mozilla Firefox browser. This flaw occurs when a bug in the javascript interpreter fails to preserve the return value of the escape function and results in uninitialized memory being used instead. This module has only been tested on...

Microsoft OWC Spreadsheet msDataSourceObject Memory Corruption

This module exploits a memory corruption vulnerability within versions 10 and 11 of the Office Web Component Spreadsheet ActiveX control. This module was based on an exploit found in the wild. Module Options msf use exploit/windows/browser/ms09/043owcmsdso msf undefined043owcmsdso show actions...

Generic Emailer (SMTP)

This module can be used to automate email delivery. This code is based on Joshua Abraham's email script for social engineering. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'yaml' class MetasploitModule...

AwingSoft Winds3D Player SceneURL Buffer Overflow

This module exploits a data segment buffer overflow within Winds3D Viewer of AwingSoft Awakening 3.x WindsPly.ocx v3.6.0.0. This ActiveX is a plugin of AwingSoft Web3D Player. By setting an overly long value to the 'SceneURL' property, an attacker can overrun a buffer and execute arbitrary code...

Wyse Rapport Hagent Fake Hserver Command Execution

This module exploits the Wyse Rapport Hagent service by pretending to be a legitimate server. This process involves starting both HTTP and FTP services on the attacker side, then contacting the Hagent service of the target and indicating that an update is available. The target will then download...

Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access

This module tests for a logic vulnerability in the Cisco VPN Concentrator 3000 series. It is possible to execute some FTP statements without authentication CWD, RNFR, MKD, RMD, SIZE, CDUP. It also appears to have some memory leak bugs when working with CWD commands. This module simply creates an...