Foxit Reader Authorization Bypass

This module exploits an authorization bypass vulnerability in Foxit Reader build 1120. When an attacker creates a specially crafted pdf file containing an Open/Execute action, arbitrary commands can be executed without confirmation from the victim. Module Options msf use...

Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow

This module exploits a buffer overflow in Foxit Reader 3.0 builds 1301 and earlier. Due to the way Foxit Reader handles the input from an "Launch" action, it is possible to cause a stack-based buffer overflow, allowing an attacker to gain arbitrary code execution under the context of the user...

Microsoft SRV.SYS WriteAndX Invalid DataOffset

This module exploits a denial of service vulnerability in the SRV.SYS driver of the Windows operating system. This module has been tested successfully against Windows Vista. This module requires Metasploit: https://metasploit.com/download Current source:...

Belkin Bulldog Plus Web Service Buffer Overflow

This module exploits a stack buffer overflow in Belkin Bulldog Plus 4.0.2 build 1219. When sending a specially crafted http request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/belkin/bulldog msf undefinedbulldog show actions ...actions... msf...

Dogfood CRM spell.php Remote Command Execution

This module exploits a previously unpublished vulnerability in the Dogfood CRM mail function which is vulnerable to command injection in the spell check feature. Because of character restrictions, this exploit works best with the double-reverse telnet payload. This vulnerability was discovered by...

POP Peeper v3.4 UIDL Buffer Overflow

This module exploits a stack buffer overflow in POP Peeper v3.4. When a specially crafted UIDL string is sent to a client, an attacker may be able to execute arbitrary code. This module is based off of krakowlabs code. Module Options msf use exploit/windows/misc/poppeeper/uidl msf undefineduidl...

POP Peeper v3.4 DATE Buffer Overflow

This module exploits a stack buffer overflow in POP Peeper v3.4. When a specially crafted DATE string is sent to a client, an attacker may be able to execute arbitrary code. This module is based off of krakowlabs code. Module Options msf use exploit/windows/misc/poppeeper/date msf undefineddate...

ContentKeeper Web Remote Command Execution

This module exploits the ContentKeeper Web Appliance. Versions prior to 125.10 are affected. This module exploits a combination of weaknesses to enable remote command execution as the Apache user. By setting SkipEscalation to false, this module will attempt to setuid the bash shell. Module Option...

Adobe JBIG2Decode Heap Corruption

This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier. This module relies upon javascript for the heap spray. Module Options msf use exploit/windows/browser/adobe/jbig2decode msf undefinedjbig2decode show actions ...actions... msf undefinedjbig2decode set...

Adobe JBIG2Decode Memory Corruption

This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier. This module relies upon javascript for the heap spray. Module Options msf use exploit/windows/fileformat/adobe/jbig2decode msf undefinedjbig2decode show actions ...actions... msf undefinedjbig2decode set...

Typo3 sa-2009-002 File Disclosure

This module exploits a file disclosure vulnerability in the jumpUrl mechanism of Typo3. This flaw can be used to read any file that the web server user account has access to. Module Options msf use auxiliary/admin/http/typo3/sa2009002 msf undefinedsa2009002 show actions ...actions... msf...

MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption

This module exploits an error related to the CFunctionPointer function when attempting to access uninitialized memory. A remote attacker could exploit this vulnerability to corrupt memory and execute arbitrary code on the system with the privileges of the victim. Module Options msf use...

FeedDemon Stack Buffer Overflow

This module exploits a buffer overflow in FeedDemon v3.1.0.12. When the application is used to import a specially crafted opml file, a buffer overflow occurs allowing arbitrary code execution. All versions are suspected to be vulnerable. This vulnerability was originally reported against version...

Orbit Downloader Connecting Log Creation Buffer Overflow

This module exploits a stack buffer overflow in Orbit Downloader 2.8.4. When an attacker serves up a malicious web site, arbitrary code may be executed. The PAYLOAD windows/shellbindtcp works best. Module Options msf use exploit/windows/browser/orbit/connecting msf undefinedconnecting show action...

Free Download Manager Torrent Parsing Buffer Overflow

This module exploits a stack buffer overflow in Free Download Manager 3.0 Build 844. Arbitrary code execution could occur when parsing a specially crafted torrent file. Module Options msf use exploit/windows/fileformat/fdm/torrent msf undefinedtorrent show actions ...actions... msf undefinedtorre...

Free Download Manager Remote Control Server Buffer Overflow

This module exploits a stack buffer overflow in Free Download Manager Remote Control 2.5 Build 758. When sending a specially crafted Authorization header, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/fdm/authheader msf undefinedauthheader show...

Oracle TNS Listener Command Issuer

This module allows for the sending of arbitrary TNS commands in order to gather information. Inspired from tnscmd.pl from www.jammed.com/jwa/hacks/security/tnscmd/tnscmd Module Options msf use auxiliary/admin/oracle/tnscmd msf undefinedtnscmd show actions ...actions... msf undefinedtnscmd set...

Wardialer

Scan for dial-up systems that are connected to modems and answer telephony indials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zlib' Extend Object class to include savetofile and loadfromfile methods cla...

Amaya Browser v11.0 'bdo' Tag Overflow

This module exploits a stack buffer overflow in the Amaya v11 Browser. By sending an overly long string to the "bdo" tag, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/amaya/bdo msf undefinedbdo show actions ...actions... msf undefinedbdo set...

FTP Bounce Port Scanner

Enumerate TCP services via the FTP bounce PORT/LIST method. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTP Bounce Port Scanner', 'Description' = %q Enumerate TCP services via the FTP bounc...

Tomcat Administration Tool Default Access

Detect the Tomcat administration interface. The administration interface is included in versions 5.5 and lower. Port 8180 is the default for FreeBSD, 8080 for all others. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewor...

HP OpenView Network Node Manager Toolbar.exe CGI Cookie Handling Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.0 and 7.53. By sending a CGI request with a specially OvOSLocale cookie to Toolbar.exe, an attacker may be able to execute arbitrary code. Please note that this module only works against a specific build i.e. NNM...

TYPO3 sa-2009-001 Weak Encryption Key File Disclosure

This module exploits a flaw in TYPO3 encryption ey creation process to allow for file disclosure in the jumpUrl mechanism. This flaw can be used to read any file that the web server user account has access to view. Module Options msf use auxiliary/admin/http/typo3/sa2009001 msf undefinedsa2009001...

HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow

This module exploits a stack buffer overflow in HTML Help Workshop 4.74 by creating a specially crafted hhp file. Module Options msf use exploit/windows/fileformat/hhw/hhpindexfilebof msf undefinedhhpindexfilebof show actions ...actions... msf undefinedhhpindexfilebof set ACTION msf...

Oracle MySQL UDF Payload Execution

This module creates and enables a custom UDF user defined function on the target host via the SELECT ... into DUMPFILE method of binary injection. On default Microsoft Windows installations of MySQL = use exploit/multi/mysql/mysql/udfpayload msf undefinedudfpayload show actions ...actions... msf...

Oracle MySQL for Microsoft Windows Payload Execution

This module creates and enables a custom UDF user defined function on the target host via the SELECT ... into DUMPFILE method of binary injection. On default Microsoft Windows installations of MySQL = 5.5.9, directory write permissions not enforced, and the MySQL service runs as LocalSystem. NOTE...

Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute

This module exploits a vulnerability in Symantec AppStream Client 5.x. The vulnerability is in the LaunchObj ActiveX control launcher.dll 5.1.0.82 containing the "installAppMgr" method. The insecure method can be exploited to download and execute arbitrary files in the context of the currently...

Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow

The module exploits a stack buffer overflow in Oracle Secure Backup. When sending a specially crafted NDMPCONNECTCLIENTAUTH packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/oracle/osb/ndmpauth msf undefinedndmpauth show actions ...actions... msf...

Oracle Secure Backup exec_qr() Command Injection Vulnerability

This module exploits a command injection vulnerability in Oracle Secure Backup version 10.1.0.3 to 10.2.0.2. Module Options msf use auxiliary/admin/oracle/osb/execqr msf undefinedexecqr show actions ...actions... msf undefinedexecqr set ACTION msf undefinedexecqr show options ...show and set...

Unix TTY, Interact with Established Connection

Interacts with a TTY on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo,...

TTY Nop Generator

Generates harmless padding for TTY input This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This class implements a "nop" generator for TTY payloads class MetasploitModule 'TTY Nop Generator', 'Alias' = 'ttygeneric',...

BEA WebLogic JSESSIONID Cookie Value Overflow

This module exploits a buffer overflow in BEA's WebLogic plugin. The vulnerable code is only accessible when clustering is configured. A request containing a long JSESSION cookie value can lead to arbitrary code execution. Module Options msf use exploit/windows/http/bea/weblogicjsessionid msf...

Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger

This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in the MDSYS.SDOTOPODROPFTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme 2-stage attack. Module Options ms...

Microsoft SQL Server Generic Query

This module will allow for simple SQL statements to be executed against a MSSQL/MSDE instance given the appropriate credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SQL...

Microsoft SQL Server Command Execution

This module will execute a Windows command on a MSSQL/MSDE instance via the xpcmdshell default or the spoacreate procedure more opsec safe, no output, no temporary data table. A valid username and password is required to use this module. This module requires Metasploit:...

TrendMicro Data Loss Prevention 5.5 Directory Traversal

This module tests whether a directory traversal vulnerability is present in Trend Micro DLP Data Loss Prevention Appliance v5.5 build use auxiliary/admin/http/trendmicro/dlptraversal msf undefineddlptraversal show actions ...actions... msf undefineddlptraversal set ACTION msf undefineddlptraversa...

Tomcat UTF-8 Directory Traversal Vulnerability

This module tests whether a directory traversal vulnerability is present in versions of Apache Tomcat 4.1.0 - 4.1.37, 5.5.0 - 5.5.26 and 6.0.0 - 6.0.16 under specific and non-default installations. The connector must have allowLinking set to true and URIEncoding set to UTF-8. Furthermore, the...

Oracle TNS Listener Service Version Query

This module simply queries the tnslsnr service for the Oracle build. Module Options msf use auxiliary/scanner/oracle/tnslsnr/version msf undefinedversion show actions ...actions... msf undefinedversion set ACTION msf undefinedversion show options ...show and set options... msf undefinedversion ru...

Oracle TNS Listener SID Enumeration

This module simply queries the TNS listener for the Oracle SID. With Oracle 9.2.0.8 and above the listener will be protected and the SID will have to be bruteforced or guessed. Module Options msf use auxiliary/scanner/oracle/sid/enum msf undefinedenum show actions ...actions... msf undefinedenum...

Oracle TNS Listener SID Brute Forcer

This module simply attempts to discover the protected SID. Module Options msf use auxiliary/admin/oracle/sid/brute msf undefinedbrute show actions ...actions... msf undefinedbrute set ACTION msf undefinedbrute show options ...show and set options... msf undefinedbrute run This module requires...

HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request to Toolbar.exe, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmtoolbar01 msf undefinednnmtoolbar01 show actions...

TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access

This module tests for directory traversal vulnerability in the UpdateAgent function in the OfficeScanNT Listener TmListen.exe service in Trend Micro OfficeScan. This allows remote attackers to read arbitrary files as SYSTEM via dot dot sequences in an HTTP request. This module requires Metasploit...

Destiny Media Player 1.61 PLS M3U Buffer Overflow

This module exploits a stack-based buffer overflow in the Destiny Media Player 1.61. An attacker must send the file to victim and the victim must open the file. File--Open Playlist Module Options msf use exploit/windows/fileformat/destinymediaplayer16 msf undefineddestinymediaplayer16 show action...

SasCam Webcam Server v.2.6.5 Get() Method Buffer Overflow

The SasCam Webcam Server ActiveX control is vulnerable to a buffer overflow. By passing an overly long argument via the Get method, a remote attacker could overflow a buffer and execute arbitrary code on the system with the privileges of the user. This control is not marked safe for scripting,...

Linux Command Shell, Bind TCP Inline (IPv6)

Listen for a connection over IPv6 and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 90 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepen...

Adobe Flash Player ActionScript Launch Command Execution Vulnerability

This module exploits a vulnerability in Adobe Flash Player for Linux, version 10.0.12.36 and 9.0.151.0 and prior. An input validation vulnerability allows command execution when the browser loads a SWF file which contains shell metacharacters in the arguments to the ActionScript launch method. Th...

Realtek Media Player Playlist Buffer Overflow

This module exploits a stack buffer overflow in Realtek Media PlayerRtlRack A4.06. When a Realtek Media Player client opens a specially crafted playlist, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/realtek/playlist msf undefinedplaylist show...

MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection

A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine MSDE without the updates supplied in MS09-00...

MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption

A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows Internal Database, and Microsoft Desktop Engine MSDE without the updates supplied in MS09-00...

MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption

This module exploits a vulnerability in the data binding feature of Internet Explorer. In order to execute code reliably, this module uses the .NET DLL memory technique pioneered by Alexander Sotirov and Mark Dowd. This method is used to create a fake vtable at a known location with all methods...