Adobe Collab.getIcon() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat. Affected versions include use exploit/windows/browser/adobe/geticon msf undefinedgeticon show actions ...actions... msf undefinedgeticon set ACTION msf undefinedgeticon show options ...show and set options... msf...

phpMyAdmin Config File Code Injection

This module exploits a vulnerability in phpMyAdmin's setup feature which allows an attacker to inject arbitrary PHP code into a configuration file. The original advisory says the vulnerability is present in phpMyAdmin versions 2.11.x use exploit/unix/webapp/phpmyadmin/config msf undefinedconfig...

Adobe Collab.getIcon() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat. Affected versions include use exploit/windows/fileformat/adobe/geticon msf undefinedgeticon show actions ...actions... msf undefinedgeticon set ACTION msf undefinedgeticon show options ...show and set options... msf...

IBM Access Support ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in IBM Access Support. When sending an overly long string to the GetXMLValue method of IbmEgath.dll 3.20.284.0 an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/ibmegath/getxmlvalue msf undefinedgetxmlval...

Mac OS X x86 iSight Photo Capture, Bind TCP Stager

Inject a Mach-O bundle to capture a photo from the iSight staged. Listen, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Mac OS X x86 bind TCP stager. module...

OS X (vfork) Command Shell, Reverse TCP Stager

Call vfork if necessary and spawn a command shell staged. Connect, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ------- Mac OS X x86 Reverse TCP stager. module...

Mac OS X Inject Mach-O Bundle, Reverse TCP Stager

Inject a custom Mach-O bundle into the exploited process. Connect, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ------- Mac OS X x86 Reverse TCP stager. module...

Mac OS X Inject Mach-O Bundle, Bind TCP Stager

Inject a custom Mach-O bundle into the exploited process. Listen, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Mac OS X x86 bind TCP stager. module MetasploitModule...

OS X (vfork) Command Shell, Bind TCP Stager

Call vfork if necessary and spawn a command shell staged. Listen, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- Mac OS X x86 bind TCP stager. module MetasploitModule...

Mac OS X x86 iSight Photo Capture, Reverse TCP Stager

Inject a Mach-O bundle to capture a photo from the iSight staged. Connect, read length, read buffer, execute This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ------- Mac OS X x86 Reverse TCP stager. module...

OS X (vfork) Command Shell, Reverse TCP Inline

Connect back to attacker, vfork if necessary, and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 131 include Msf::Payload::Single include Msf::Payload::Osx...

OS X (vfork) Command Shell, Bind TCP Inline

Listen for a connection, vfork if necessary, and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Payload::Osx...

Talkative IRC v0.4.4.16 Response Buffer Overflow

This module exploits a stack buffer overflow in Talkative IRC v0.4.4.16. When a specially crafted response string is sent to a client, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/talkative/response msf undefinedresponse show actions ...actions...

TCP SYN Flooder

A simple TCP SYN flooder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TCP SYN Flooder', 'Description' = 'A simple TCP SYN flooder', 'Author' = 'kris katterjohn', 'License' = MSFLICENSE...

IBM System Director Agent DLL Injection

This module abuses the "wmicimsv" service on IBM System Director Agent 5.20.3 to accomplish arbitrary DLL injection and execute arbitrary code with SYSTEM privileges. In order to accomplish remote DLL injection it uses a WebDAV service as disclosed by kingcope on December 2012. Because of this, t...

eZip Wizard 3.0 Stack Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in version 3.0 of ediSys Corp.'s eZip Wizard. In order for the command to be executed, an attacker must convince someone to open a specially crafted zip file with eZip Wizard, and access the specially file via double-clicking it. By...

Foxit Reader Authorization Bypass

This module exploits an authorization bypass vulnerability in Foxit Reader build 1120. When an attacker creates a specially crafted pdf file containing an Open/Execute action, arbitrary commands can be executed without confirmation from the victim. Module Options msf use...

Foxit Reader 3.0 Open Execute Action Stack Based Buffer Overflow

This module exploits a buffer overflow in Foxit Reader 3.0 builds 1301 and earlier. Due to the way Foxit Reader handles the input from an "Launch" action, it is possible to cause a stack-based buffer overflow, allowing an attacker to gain arbitrary code execution under the context of the user...

Microsoft SRV.SYS WriteAndX Invalid DataOffset

This module exploits a denial of service vulnerability in the SRV.SYS driver of the Windows operating system. This module has been tested successfully against Windows Vista. This module requires Metasploit: https://metasploit.com/download Current source:...

Belkin Bulldog Plus Web Service Buffer Overflow

This module exploits a stack buffer overflow in Belkin Bulldog Plus 4.0.2 build 1219. When sending a specially crafted http request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/belkin/bulldog msf undefinedbulldog show actions ...actions... msf...

Dogfood CRM spell.php Remote Command Execution

This module exploits a previously unpublished vulnerability in the Dogfood CRM mail function which is vulnerable to command injection in the spell check feature. Because of character restrictions, this exploit works best with the double-reverse telnet payload. This vulnerability was discovered by...

POP Peeper v3.4 UIDL Buffer Overflow

This module exploits a stack buffer overflow in POP Peeper v3.4. When a specially crafted UIDL string is sent to a client, an attacker may be able to execute arbitrary code. This module is based off of krakowlabs code. Module Options msf use exploit/windows/misc/poppeeper/uidl msf undefineduidl...

POP Peeper v3.4 DATE Buffer Overflow

This module exploits a stack buffer overflow in POP Peeper v3.4. When a specially crafted DATE string is sent to a client, an attacker may be able to execute arbitrary code. This module is based off of krakowlabs code. Module Options msf use exploit/windows/misc/poppeeper/date msf undefineddate...

ContentKeeper Web Remote Command Execution

This module exploits the ContentKeeper Web Appliance. Versions prior to 125.10 are affected. This module exploits a combination of weaknesses to enable remote command execution as the Apache user. By setting SkipEscalation to false, this module will attempt to setuid the bash shell. Module Option...

Adobe JBIG2Decode Memory Corruption

This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier. This module relies upon javascript for the heap spray. Module Options msf use exploit/windows/fileformat/adobe/jbig2decode msf undefinedjbig2decode show actions ...actions... msf undefinedjbig2decode set...

Adobe JBIG2Decode Heap Corruption

This module exploits a heap-based pointer corruption flaw in Adobe Reader 9.0.0 and earlier. This module relies upon javascript for the heap spray. Module Options msf use exploit/windows/browser/adobe/jbig2decode msf undefinedjbig2decode show actions ...actions... msf undefinedjbig2decode set...

MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption

This module exploits an error related to the CFunctionPointer function when attempting to access uninitialized memory. A remote attacker could exploit this vulnerability to corrupt memory and execute arbitrary code on the system with the privileges of the victim. Module Options msf use...

Typo3 sa-2009-002 File Disclosure

This module exploits a file disclosure vulnerability in the jumpUrl mechanism of Typo3. This flaw can be used to read any file that the web server user account has access to. Module Options msf use auxiliary/admin/http/typo3/sa2009002 msf undefinedsa2009002 show actions ...actions... msf...

FeedDemon Stack Buffer Overflow

This module exploits a buffer overflow in FeedDemon v3.1.0.12. When the application is used to import a specially crafted opml file, a buffer overflow occurs allowing arbitrary code execution. All versions are suspected to be vulnerable. This vulnerability was originally reported against version...

Orbit Downloader Connecting Log Creation Buffer Overflow

This module exploits a stack buffer overflow in Orbit Downloader 2.8.4. When an attacker serves up a malicious web site, arbitrary code may be executed. The PAYLOAD windows/shellbindtcp works best. Module Options msf use exploit/windows/browser/orbit/connecting msf undefinedconnecting show action...

Free Download Manager Torrent Parsing Buffer Overflow

This module exploits a stack buffer overflow in Free Download Manager 3.0 Build 844. Arbitrary code execution could occur when parsing a specially crafted torrent file. Module Options msf use exploit/windows/fileformat/fdm/torrent msf undefinedtorrent show actions ...actions... msf undefinedtorre...

Free Download Manager Remote Control Server Buffer Overflow

This module exploits a stack buffer overflow in Free Download Manager Remote Control 2.5 Build 758. When sending a specially crafted Authorization header, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/fdm/authheader msf undefinedauthheader show...

Oracle TNS Listener Command Issuer

This module allows for the sending of arbitrary TNS commands in order to gather information. Inspired from tnscmd.pl from www.jammed.com/jwa/hacks/security/tnscmd/tnscmd Module Options msf use auxiliary/admin/oracle/tnscmd msf undefinedtnscmd show actions ...actions... msf undefinedtnscmd set...

Wardialer

Scan for dial-up systems that are connected to modems and answer telephony indials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'zlib' Extend Object class to include savetofile and loadfromfile methods cla...

Amaya Browser v11.0 'bdo' Tag Overflow

This module exploits a stack buffer overflow in the Amaya v11 Browser. By sending an overly long string to the "bdo" tag, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/amaya/bdo msf undefinedbdo show actions ...actions... msf undefinedbdo set...

FTP Bounce Port Scanner

Enumerate TCP services via the FTP bounce PORT/LIST method. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FTP Bounce Port Scanner', 'Description' = %q Enumerate TCP services via the FTP bounc...

Tomcat Administration Tool Default Access

Detect the Tomcat administration interface. The administration interface is included in versions 5.5 and lower. Port 8180 is the default for FreeBSD, 8080 for all others. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewor...

HP OpenView Network Node Manager Toolbar.exe CGI Cookie Handling Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.0 and 7.53. By sending a CGI request with a specially OvOSLocale cookie to Toolbar.exe, an attacker may be able to execute arbitrary code. Please note that this module only works against a specific build i.e. NNM...

TYPO3 sa-2009-001 Weak Encryption Key File Disclosure

This module exploits a flaw in TYPO3 encryption ey creation process to allow for file disclosure in the jumpUrl mechanism. This flaw can be used to read any file that the web server user account has access to view. Module Options msf use auxiliary/admin/http/typo3/sa2009001 msf undefinedsa2009001...

HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow

This module exploits a stack buffer overflow in HTML Help Workshop 4.74 by creating a specially crafted hhp file. Module Options msf use exploit/windows/fileformat/hhw/hhpindexfilebof msf undefinedhhpindexfilebof show actions ...actions... msf undefinedhhpindexfilebof set ACTION msf...

Oracle MySQL UDF Payload Execution

This module creates and enables a custom UDF user defined function on the target host via the SELECT ... into DUMPFILE method of binary injection. On default Microsoft Windows installations of MySQL = use exploit/multi/mysql/mysql/udfpayload msf undefinedudfpayload show actions ...actions... msf...

Oracle MySQL for Microsoft Windows Payload Execution

This module creates and enables a custom UDF user defined function on the target host via the SELECT ... into DUMPFILE method of binary injection. On default Microsoft Windows installations of MySQL = 5.5.9, directory write permissions not enforced, and the MySQL service runs as LocalSystem. NOTE...

Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute

This module exploits a vulnerability in Symantec AppStream Client 5.x. The vulnerability is in the LaunchObj ActiveX control launcher.dll 5.1.0.82 containing the "installAppMgr" method. The insecure method can be exploited to download and execute arbitrary files in the context of the currently...

Oracle Secure Backup NDMP_CONNECT_CLIENT_AUTH Buffer Overflow

The module exploits a stack buffer overflow in Oracle Secure Backup. When sending a specially crafted NDMPCONNECTCLIENTAUTH packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/oracle/osb/ndmpauth msf undefinedndmpauth show actions ...actions... msf...

Oracle Secure Backup exec_qr() Command Injection Vulnerability

This module exploits a command injection vulnerability in Oracle Secure Backup version 10.1.0.3 to 10.2.0.2. Module Options msf use auxiliary/admin/oracle/osb/execqr msf undefinedexecqr show actions ...actions... msf undefinedexecqr set ACTION msf undefinedexecqr show options ...show and set...

Unix TTY, Interact with Established Connection

Interacts with a TTY on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Single def initializeinfo = supermergeinfoinfo,...

TTY Nop Generator

Generates harmless padding for TTY input This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This class implements a "nop" generator for TTY payloads class MetasploitModule 'TTY Nop Generator', 'Alias' = 'ttygeneric',...

BEA WebLogic JSESSIONID Cookie Value Overflow

This module exploits a buffer overflow in BEA's WebLogic plugin. The vulnerable code is only accessible when clustering is configured. A request containing a long JSESSION cookie value can lead to arbitrary code execution. Module Options msf use exploit/windows/http/bea/weblogicjsessionid msf...

Oracle DB SQL Injection in MDSYS.SDO_TOPO_DROP_FTBL Trigger

This module will escalate an Oracle DB user to MDSYS by exploiting a sql injection bug in the MDSYS.SDOTOPODROPFTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme 2-stage attack. Module Options ms...

Microsoft SQL Server Generic Query

This module will allow for simple SQL statements to be executed against a MSSQL/MSDE instance given the appropriate credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SQL...