SMB User Enumeration (SAM EnumUsers)

Determine what users exist via the SAM RPC service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB User Enumeration SAM EnumUsers', 'Description' = 'Determine what users exist via the SAM R...

PostgreSQL Server Generic Query

This module imports a file local on the PostgreSQL Server into a temporary table, reads it, and then drops the temporary table. It requires PostgreSQL credentials with table CREATE privileges as well as read privileges to the target file. This module requires Metasploit:...

Microsoft IIS WebDAV Write Access Code Execution

This module can be used to execute a payload on IIS servers that have world-writeable directories. The payload is uploaded as an ASP script via a WebDAV PUT request. The target IIS machine must meet these conditions to be considered as exploitable: It allows 'Script resource access', Read and Wri...

AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow

This module exploits a buffer overflow vulnerability in opcode 21 handled by rpc.cmsd on AIX. By making a request with a long string passed to the first argument of the "rtablecreate" RPC, a stack based buffer overflow occurs. This leads to arbitrary code execution. NOTE: Unsuccessful attempts ma...

AIX execve Shell for inetd

Simply execve /bin/sh for inetd programs This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 56 include Msf::Payload::Single include Msf::Payload::Aix include...

Vermillion FTP Daemon PORT Command Memory Corruption

This module exploits an out-of-bounds array access in the Arcane Software Vermillion FTP server. By sending a specially crafted FTP PORT command, an attacker can corrupt stack memory and execute arbitrary code. This particular issue is caused by processing data bound by attacker controlled input...

Samba Symlink Directory Traversal

This module exploits a directory traversal flaw in the Samba CIFS server. To exploit this flaw, a writeable share must be specified. The newly created directory will link to the root filesystem. This module requires Metasploit: https://metasploit.com/download Current source:...

AstonSoft DeepBurner (DBR File) Path Buffer Overflow

This module exploits a stack-based buffer overflow in versions 1.9.0.228, 1.8.0, and possibly other versions of AstonSoft's DeepBurner Pro, Lite, etc. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an...

Juniper JunOS Malformed TCP Option

This module exploits a denial of service vulnerability in Juniper Network's JunOS router operating system. By sending a TCP packet with TCP option 101 set, an attacker can cause an affected router to reboot. This module requires Metasploit: https://metasploit.com/download Current source:...

Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow

The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer overflow. This bug found and reported by babi. This particular exploit targets the dissectgetaddrsbynamerequest function. Several...

PostgreSQL Server Generic Query

This module will allow for simple SQL statements to be executed against a PostgreSQL instance given the appropriate credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PostgreSQL Serve...

Novell iPrint Client ActiveX Control Date/Time Buffer Overflow

This module exploits a stack buffer overflow in Novell iPrint Client 5.30. When passing a specially crafted date/time string via certain parameters to ienipp.ocx an attacker can execute arbitrary code. NOTE: The "operation" variable must be set to a valid command in order to reach this...

HTTP trace.axd Content Scanner

Detect trace.axd files and analyze its content This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP trace.axd Content Scanner', 'Description' = 'Detect trace.axd files and analyze its content',...

HTTP Virtual Host Brute Force Scanner

This module tries to identify unique virtual hosts hosted by the target web server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework May I reuse some methods? require 'cgi' class MetasploitModule 'HTTP Virtual Host Bru...

HTTP Backup File Scanner

This module identifies the existence of possible copies of a specific file in a given path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Backup File Scanner', 'Description' = %q This...

HTTP Directory Listing Scanner

This module identifies directory listing vulnerabilities in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Directory Listing Scanner', 'Description' = %q This modu...

HTTP SSL Certificate Information

Parse the server SSL certificate to obtain the common name and signature algorithm...

HTTP File Same Name Directory Scanner

This module identifies the existence of files in a given directory path named as the same name of the directory. Only works if PATH is different than '/'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

MS09-020 IIS6 WebDAV Unicode Auth Bypass Directory Scanner

This module is based on et's HTTP Directory Scanner module, with one exception. Where authentication is required, it attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS...

HTTP Subversion Scanner

Detect subversion directories and files and analyze its content. Only SVN Version 7 supported This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Subversion Scanner', 'Description' = 'Detect...

HTTP WebDAV Scanner

Detect webservers with WebDAV enabled This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Scanner', 'Description' = 'Detect webservers with WebDAV enabled', 'Author' = 'et', 'License' =...

HTTP Interesting File Scanner

This module identifies the existence of interesting files in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Interesting File Scanner', 'Description' = %q This modu...

HTTP Robots.txt Content Scanner

Detect robots.txt files and analyze its content This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Robots.txt Content Scanner', 'Description' = 'Detect robots.txt files and analyze its...

HTTP SOAP Verb/Noun Brute Force Scanner

This module attempts to brute force SOAP/XML requests to uncover hidden methods. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP SOAP Verb/Noun Brute Force Scanner', 'Description' = %q Thi...

HTTP Directory Scanner

This module identifies the existence of interesting directories in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'thread' class MetasploitModule 'HTTP Directory Scanner', 'Description...

HTTP WebDAV Internal IP Scanner

Detect webservers internal IPs though WebDAV This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Internal IP Scanner', 'Description' = 'Detect webservers internal IPs though WebDAV',...

HTTP Error Based SQL Injection Scanner

This module identifies the existence of Error Based SQL injection issues. Still requires a lot of work This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Error Based SQL Injection Scanner',...

HTTP Verb Authentication Bypass Scanner

This module test for authentication bypass using different HTTP verbs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Verb Authentication Bypass Scanner', 'Description' = %q This module...

HTTP SSL Certificate Checker

This module will check the certificate of the specified web servers to ensure the subject and issuer match the supplied pattern and that the certificate is not expired. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

HTTP File Extension Scanner

This module identifies the existence of additional files by modifying the extension of an existing file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'pathname' class MetasploitModule 'HTTP File Extension...

HTTP Blind XPATH 1.0 Injector

This module exploits blind XPATH 1.0 injections over HTTP GET requests. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Blind XPATH 1.0 Injector', 'Description' = %q This module exploits...

HTTP Copy File Scanner

This module identifies the existence of possible copies of a specific file in a given path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Copy File Scanner', 'Description' = %q This modu...

HTTP Directory Brute Force Scanner

This module identifies the existence of interesting directories by brute forcing the name in a given directory path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'enumerable' class MetasploitModule 'HTTP...

HTTP WebDAV Website Content Scanner

Detect webservers disclosing its content though WebDAV This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP WebDAV Website Content Scanner', 'Description' = 'Detect webservers disclosing its...

HTTP Previous Directory File Scanner

This module identifies files in the first parent directory with same name as the given directory path. Example: Test /backup/files/ will look for the following files /backup/files.ext . This module requires Metasploit: https://metasploit.com/download Current source:...

Archive.org Stored Domain URLs

This module pulls and parses the URLs stored by Archive.org for the purpose of replaying during a web assessment. Finding unlinked and old pages. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/http' clas...

Audiotran 1.4.1 (PLS File) Stack Buffer Overflow

This module exploits a stack-based buffer overflow in Audiotran 1.4.1. An attacker must send the file to victim and the victim must open the file. Alternatively it may be possible to execute code remotely via an embedded PLS file within a browser, when the PLS extension is registered to Audiotran...

AOL 9.5 Phobos.Playlist Import() Stack-based Buffer Overflow

This module exploits a stack-based buffer overflow within Phobos.dll of AOL 9.5. By setting an overly long value to 'Import', an attacker can overrun a buffer and execute arbitrary code. NOTE: This ActiveX control is NOT marked safe for scripting or initialization. This module requires Metasploit...

NTP Monitor List Scanner

This module identifies NTP servers which permit "monlist" queries and obtains the recent clients list. The monlist feature allows remote attackers to cause a denial of service traffic amplification via spoofed requests. The more clients there are in the list, the greater the amplification. This...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MySQL yaSSL SSL Hello Message Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MC' ,...

MySQL yaSSL CertDecoder::GetName Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.9.8 and earlier implementation bundled with MySQL. By sending a specially crafted client certificate, an attacker can execute arbitrary code. This vulnerability is present within the CertDecoder::GetName function inside...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MySQL yaSSL SSL Hello Message Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL 'MC' ,...

DB2 Probe Utility

This module queries a DB2 instance information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DB2 Probe Utility', 'Description' = 'This module queries a DB2 instance information.', 'Author' =...

HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53. By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute arbitrary code. This specific vulnerability is due to a call to "sprintfnew" in the "isWide" function within "ovalarm.exe". A...

Oracle 10gR2 TNS Listener AUTH_SESSKEY Buffer Overflow

This module exploits a stack buffer overflow in Oracle. When sending a specially crafted packet containing a long AUTHSESSKEY value to the TNS service, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

FTP Version Scanner

Detect FTP Version. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTP Version Scanner', 'Description' = 'Detect FTP Version.', 'Author' = 'hdm', 'License' = MSFLICENSE registeroptions...

SSH Version Scanner

Detect SSH Version, and the server encryption This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'recog' require 'net/ssh/transport/session' class MetasploitModule 'SSH Version Scanner', 'Description' = 'Detect S...

Finger Service User Enumerator

Identify valid users through the finger service using a variety of tricks This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Finger Service User Enumerator', 'Description' = 'Identify valid users...

HTTP Version Detection

Display version information about each system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Version Detection', 'Description' = 'Display version information about each system.', 'Author...

MySQL Server Version Enumeration

Enumerates the version of MySQL servers. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MySQL Server Version Enumeration', 'Description' = %q Enumerates the version of MySQL servers. , 'Author...