Microsoft DirectShow (msvidctl.dll) MPEG-2 Memory Corruption

This module exploits a memory corruption within the MSVidCtl component of Microsoft DirectShow BDATuner.MPEG2TuneRequest. By loading a specially crafted GIF file, an attacker can overrun a buffer and execute arbitrary code. ClassID is now configurable via an advanced option otherwise randomized -...

ColdFusion 8.0.1 Arbitrary File Upload and Execute

This module exploits the Adobe ColdFusion 8.0.1 FCKeditor 'CurrentFolder' File Upload and Execute vulnerability. Module Options msf use exploit/windows/http/coldfusion/fckeditor msf undefinedfckeditor show actions ...actions... msf undefinedfckeditor set ACTION msf undefinedfckeditor show options...

Iomega StorCenter Pro NAS Web Authentication Bypass

The Iomega StorCenter Pro Network Attached Storage device web interface increments sessions IDs, allowing for simple brute force attacks to bypass authentication and gain administrative access. This module requires Metasploit: https://metasploit.com/download Current source:...

Media Jukebox 8.0.400 Buffer Overflow (SEH)

This module exploits a stack buffer overflow in Media Jukebox 8.0.400 by creating a specially crafted m3u or pls file. Module Options msf use exploit/windows/fileformat/mediajukebox msf undefinedmediajukebox show actions ...actions... msf undefinedmediajukebox set ACTION msf undefinedmediajukebox...

System V Derived /bin/login Extraneous Arguments Buffer Overflow

This exploit connects to a system's modem over dialup and exploits a buffer overflow vulnerability in it's System V derived /bin/login. The vulnerability is triggered by providing a large number of arguments. This module requires Metasploit: https://metasploit.com/download Current source:...

HT-MP3Player 1.0 HT3 File Parsing Buffer Overflow

This module exploits a stack buffer overflow in HT-MP3Player 1.0. Arbitrary code execution could occur when parsing a specially crafted .HT3 file. NOTE: The player installation does not register the file type to be handled. Therefore, a user must take extra steps to load this file. Module Options...

Timbuktu PlughNTCommand Named Pipe Buffer Overflow

This module exploits a stack based buffer overflow in Timbuktu Pro version use exploit/windows/smb/timbuktu/plughntcommandbof msf undefinedplughntcommandbof show actions ...actions... msf undefinedplughntcommandbof set ACTION msf undefinedplughntcommandbof show options ...show and set options...

VideoLAN Client (VLC) Win32 smb:// URI Buffer Overflow

This module exploits a stack-based buffer overflow in the Win32AddConnection function of the VideoLAN VLC media player. Versions 0.9.9 through 1.0.1 are reportedly affected. This vulnerability is only present in Win32 builds of VLC. This payload was found to work with the windows/exec and...

Nagios3 statuswml.cgi Ping Command Execution

This module abuses a metacharacter injection vulnerability in the Nagios3 statuswml.cgi script. This flaw is triggered when shell metacharacters are present in the parameters to the ping and traceroute commands. Module Options msf use exploit/unix/webapp/nagios3/statuswmlping msf...

Bopup Communications Server Buffer Overflow

This module exploits a stack buffer overflow in Bopup Communications Server 3.2.26.5460. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/bopup/comm msf undefinedcomm show actions ...actions... msf undefinedcomm...

TFTP Brute Forcer

This module uses a dictionary to brute force valid TFTP image names from a TFTP server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TFTP Brute Forcer', 'Description' = 'This module uses a...

ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)

This module exploits a buffer overflow vulnerability in ttinternalrealpath function of the ToolTalk database server rpc.ttdbserverd. Module Options msf use exploit/aix/rpc/ttdbserverdrealpath msf undefinedttdbserverdrealpath show actions ...actions... msf undefinedttdbserverdrealpath set ACTION m...

Slowloris Denial of Service Attack

Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to-but never completing-the...

Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5

Some TLS implementations handle errors processing RSA key exchanges and encryption PKCS 1 v1.5 messages in a broken way that leads an adaptive chosen-chiphertext attack. Attackers cannot recover a server's private key, but they can decrypt and sign messages with it. A strong oracle occurs when th...

Green Dam URL Processing Buffer Overflow

This module exploits a stack-based buffer overflow in Green Dam Youth Escort version 3.17 in the way it handles overly long URLs. By setting an overly long URL, an attacker can overrun a buffer and execute arbitrary code. This module uses the .NET DLL memory technique by Alexander Sotirov and Mar...

Worldweaver DX Studio Player shell.execute() Command Execution

This module exploits a command execution vulnerability within the DX Studio Player from Worldweaver for versions 3.0.29 and earlier. The player is a browser plugin for IE ActiveX and Firefox dll. When an unsuspecting user visits a web page referring to a specially crafted .dxstudio document, an...

PeaZip Zip Processing Command Injection

This module exploits a command injection vulnerability in PeaZip. All versions prior to 2.6.2 are suspected vulnerable. Testing was conducted with version 2.6.1 on Windows. In order for the command to be executed, an attacker must convince someone to open a specially crafted zip file with PeaZip,...

Apple OS X iTunes 8.1.1 ITMS Overflow

This modules exploits a stack-based buffer overflow in iTunes itms:// URL parsing. It is accessible from the browser and in Safari, itms urls will be opened in iTunes automatically. Because iTunes is multithreaded, only vfork-based payloads should be used. Module Options msf use...

SafeNet SoftRemote IKE Service Buffer Overflow

This module exploits a stack buffer overflow in Safenet SoftRemote IKE IreIKE.exe service. When sending a specially crafted udp packet to port 62514 an attacker may be able to execute arbitrary code. This module has been tested with Juniper NetScreen-Remote 10.8.0 Build 20 using...

SonicWALL SSL-VPN Format String Vulnerability

There is a format string vulnerability within the SonicWALL SSL-VPN Appliance - 200, 2000 and 4000 series. Arbitrary memory can be read or written to, depending on the format string used. There appears to be a length limit of 127 characters of format string data. With physical access to the devic...

Winamp MAKI Buffer Overflow

This module exploits a stack based buffer overflow in Winamp 5.55. The flaw exists in the genff.dll and occurs while parsing a specially crafted MAKI file, where memmove is used in an insecure way with user controlled data. To exploit the vulnerability the attacker must convince the victim to...

AOL Radio AmpX ActiveX Control ConvertFile() Buffer Overflow

This module exploits a stack-based buffer overflow in AOL IWinAmpActiveX class AmpX.dll version 2.4.0.6 installed via AOL Radio website. By setting an overly long value to 'ConvertFile', an attacker can overrun a buffer and execute arbitrary code. Module Options msf use...

NetDecision 4.2 TFTP Directory Traversal

This modules exploits a directory traversal vulnerability in NetDecision 4.2 TFTP service. Module Options msf use auxiliary/scanner/tftp/netdecision/tftp msf undefinedtftp show actions ...actions... msf undefinedtftp set ACTION msf undefinedtftp show options ...show and set options... msf...

NetDecision 4.2 TFTP Writable Directory Traversal Execution

This module exploits a vulnerability found in NetDecision 4.2 TFTP server. The software contains a directory traversal vulnerability that allows a remote attacker to write arbitrary file to the file system, which results in code execution under the context of user executing the TFTP Server. Modul...

Windows Meterpreter Service, Bind TCP

Stub payload for interacting with a Meterpreter Service This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Windows include Msf::Payload::Single include...

Oracle DB SQL Injection via SYS.LT.ROLLBACKWORKSPACE

This module exploits a sql injection flaw in the ROLLBACKWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability. Module Options msf use auxiliary/sqli/oracle/lt/rollbackworkspace msf undefinedrollbackworkspace sho...

Oracle Enterprise Manager Control SID Discovery

This module makes a request to the Oracle Enterprise Manager Control Console in an attempt to discover the SID. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Enterprise Manager Control...

Oracle XML DB SID Discovery

This module simply makes an authenticated request to retrieve the sid from the Oracle XML DB httpd server. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle XML DB SID Discovery',...

Oracle Application Server Spy Servlet SID Enumeration

This module makes a request to the Oracle Application Server in an attempt to discover the SID. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle Application Server Spy Servlet SID...

PHP Base64 Encoder

This encoder returns a base64 string encapsulated in evalbase64decode, increasing the size by a bit more than one third. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PHP Base64 Encoder',...

BaoFeng Storm mps.dll ActiveX OnBeforeVideoDownload Buffer Overflow

This module exploits a buffer overflow in BaoFeng's Storm media Player ActiveX control. Versions of mps.dll including 3.9.4.27 and lower are affected. When passing an overly long string to the method "OnBeforeVideoDownload" an attacker can execute arbitrary code. Module Options msf use...

Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution

Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use exploit/windows/antivirus/ams/xfr msf undefinedxfr show actions ...actions... msf undefinedxfr set...

Symantec Alert Management System Intel Alert Originator Service Buffer Overflow

This module exploits a stack buffer overflow in Intel Alert Originator Service msgsys.exe. When an attacker sends a specially crafted alert, arbitrary code may be executed. Module Options msf use exploit/windows/antivirus/symantec/iao msf undefinediao show actions ...actions... msf undefinediao s...

Linux udev Netlink Local Privilege Escalation

Versions of udev use exploit/linux/local/udev/netlink msf undefinednetlink show actions ...actions... msf undefinednetlink set ACTION msf undefinednetlink show options ...show and set options... msf undefinednetlink run This module requires Metasploit: https://metasploit.com/download Current...

Microsoft Whale Intelligent Application Gateway ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Microsoft Whale Intelligent Application Gateway Whale Client. When sending an overly long string to CheckForUpdates method of WhlMgr.dll 3.1.502.64 an attacker may be able to execute arbitrary code. Module Options msf use...

EnjoySAP SAP GUI ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system by abusing the "CompDownload" method in the SAP KWEdit ActiveX Control kwedit.dll 6400.1.1.41. Module Options msf use exploit/windows/browser/enjoysapgui/compdownload msf undefinedcompdownload show actions...

TCP "XMas" Port Scanner

Enumerate open|filtered TCP services using a raw "XMas" scan; this sends probes containing the FIN, PSH and URG flags. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TCP "XMas" Port Scanner',...

HTTP Options Detection

Display available HTTP options for each system This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP Options Detection', 'Description' = 'Display available HTTP options for each system', 'Author...

TCP ACK Firewall Scanner

Map out firewall rulesets with a raw ACK scan. Any unfiltered ports found means a stateful firewall is not in place for them. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TCP ACK Firewall...

PostgreSQL for Microsoft Windows Payload Execution

On default Microsoft Windows installations of PostgreSQL the postgres service account may write to the current directory which is usually "C:\Program Files\PostgreSQL\data" where is the major.minor version of PostgreSQL. UDF DLL's may be sourced from there as well. This module uploads a Windows...

Oracle SMB Relay Code Execution

This module will help you to get Administrator access to OS using an unprivileged Oracle database user you need only CONNECT and RESOURCE privileges. To do this you must firstly run smbsniffer or smbrelay module on your server. Then you must connect to Oracle database and run this module...

Novell NetIdentity Agent XTIERRPCPIPE Named Pipe Buffer Overflow

This module exploits a stack buffer overflow in Novell's NetIdentity Agent. When sending a specially crafted string to the 'XTIERRPCPIPE' named pipe, an attacker may be able to execute arbitrary code. The success of this module is much greater once the service has been restarted. Module Options m...

IPID Sequence Scanner

This module will probe hosts' IPID sequences and classify them using the same method Nmap uses when it's performing its IPID Idle Scan -sI and OS Detection -O. Nmap's probes are SYN/ACKs while this module's are SYNs. While this does not change the underlying functionality, it does change the chan...

UltraISO CCD File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in EZB Systems, Inc's UltraISO. When processing .CCD files, data is read from file into a fixed-size stack buffer. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by convincing their victim to...

SIP Username Enumerator (UDP)

Scan for numeric username/extensions using OPTIONS/REGISTER requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Username Enumerator UDP', 'Description' = 'Scan for numeric...

Autodesk IDrop ActiveX Control Heap Memory Corruption

This module exploits a heap-based memory corruption vulnerability in Autodesk IDrop ActiveX control IDrop.ocx version 17.1.51.160. An attacker can execute arbitrary code by triggering a heap use after free condition using the Src, Background, PackageXml properties. Module Options msf use...

SAP AG SAPgui EAI WebViewer3D Buffer Overflow

This module exploits a stack buffer overflow in Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled with SAPgui. When passing an overly long string the SaveViewToSessionFile method, arbitrary code may be executed. Module Options msf use...

SIP Endpoint Scanner (UDP)

Scan for SIP devices using OPTIONS requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Endpoint Scanner UDP', 'Description' = 'Scan for SIP devices using OPTIONS requests', 'Author' =...

XM Easy Personal FTP Server 5.7.0 NLST DoS

You need a valid login to DoS this FTP server, but even anonymous can do it as long as it has permission to call NLST. Module Options msf use auxiliary/dos/windows/ftp/xmeasy570/nlst msf undefinednlst show actions ...actions... msf undefinednlst set ACTION msf undefinednlst show options ...show a...

TCP SYN Port Scanner

Enumerate open TCP services using a raw SYN scan. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TCP SYN Port Scanner', 'Description' = %q Enumerate open TCP services using a raw SYN scan. ,...