Windows Command Shell, Bind IPv6 TCP Stager (Windows x86)

Spawn a piped command shell staged. Listen for an IPv6 connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Reverse TCP Stager (IPv6)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Reflective DLL Injection, Reverse TCP Stager (IPv6)

Inject a DLL via a reflective loader. Connect back to the attacker over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 289 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for an IPv6 connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

VNC Server (Reflective Injection), Bind IPv6 TCP Stager (Windows x86)

Inject a VNC Dll via a reflective loader staged. Listen for an IPv6 connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Bind IPv6 TCP Stager (Windows x86)

Inject the meterpreter server DLL staged. Listen for an IPv6 connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (IPv6)

Inject the meterpreter server DLL staged. Connect back to the attacker over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 289 include Msf::Payload::Stager include...

Reflective DLL Injection, Bind IPv6 TCP Stager (Windows x86)

Inject a DLL via a reflective loader. Listen for an IPv6 connection Windows x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 298 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Reflective DLL Injection, Reverse TCP Stager (No NX or Win7)

Inject a DLL via a reflective loader. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include...

Reflective DLL Injection, Bind TCP Stager (No NX or Win7)

Inject a DLL via a reflective loader. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include Msf::Payload::Windows d...

VNC Server (Reflective Injection), Reverse TCP Stager (No NX or Win7)

Inject a VNC Dll via a reflective loader staged. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include...

Windows Inject DLL, Reverse TCP Stager (No NX or Win7)

Inject a custom DLL into the exploited process. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Reverse TCP Stager (No NX or Win7)

Inject the meterpreter server DLL staged. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Bind TCP Stager (No NX or Win7)

Inject the meterpreter server DLL staged. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include Msf::Payload::Windo...

Windows Command Shell, Reverse TCP Stager (No NX or Win7)

Spawn a piped command shell staged. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include Msf::Payload::Window...

Windows Command Shell, Bind TCP Stager (No NX or Win7)

Spawn a piped command shell staged. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include Msf::Payload::Windows def...

Windows Inject DLL, Bind TCP Stager (No NX or Win7)

Inject a custom DLL into the exploited process. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include...

VNC Server (Reflective Injection), Bind TCP Stager (No NX or Win7)

Inject a VNC Dll via a reflective loader staged. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModul...

Windows Upload/Execute, Reverse TCP Stager (No NX or Win7)

Uploads an executable and runs it staged. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include...

Windows Upload/Execute, Bind TCP Stager (No NX or Win7)

Uploads an executable and runs it staged. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include Msf::Payload::Windo...

Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow

This module exploits a stack buffer overflow in Microsoft Visual Studio 6.0. When passing a specially crafted string to the Mask parameter of the Mdmask32.ocx ActiveX Control, an attacker may be able to execute arbitrary code. Module Options msf use...

Racer v0.5.3 Beta 5 Buffer Overflow

This module exploits the Racer Car and Racing Simulator game versions v0.5.3 beta 5 and earlier. Both the client and server listen on UDP port 26000. By sending an overly long buffer we are able to execute arbitrary code remotely. Module Options msf use exploit/windows/games/racer/503beta5 msf...

Ruby WEBrick::HTTP::DefaultFileHandler DoS

The WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 to 1.8.6-p286, 1.8.7 to 1.8.7-p71, and 1.9 to r18423 allows for a DoS CPU consumption via a crafted HTTP request. Module Options msf use auxiliary/dos/http/webrick/regex msf undefinedregex show actions ...actions...

WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow

This module exploits a stack-based buffer overflow in WebEx's WebexUCFObject ActiveX Control. If a long string is passed to the 'NewObject' method, a stack- based buffer overflow will occur when copying attacker-supplied data using the sprintf function. It is noteworthy that this vulnerability wa...

McAfee Remediation Client ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in McAfee Remediation Agent 4.5.0.41. When sending an overly long string to the DeleteSnapshot method of enginecom.dll 3.7.0.9 an attacker may be able to execute arbitrary code. This control is not marked safe for scripting, so choose your attack vecto...

DNS Spoofing Helper Service

This module provides a DNS service that returns TXT records indicating information about the querying service. Based on Dino Dai Zovi DNS code from Karma. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'resol...

DNS Lookup Result Comparison

This module can be used to determine differences in the cache entries between two DNS servers. This is primarily useful for detecting cache poisoning attacks, but can also be used to detect geo-location load balancing. Module Options msf use auxiliary/spoof/dns/compare/results msf undefinedresult...

DNS BailiWicked Domain Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit replaces the target domains nameserver entries in a vulnerable DNS cache server. This attack works by sending random hostname queries to the target DNS server coupled...

DNS BailiWicked Host Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random hostname queries to the target DNS server coupled with spoofed replies to those...

Oracle Weblogic Apache Connector POST Request Buffer Overflow

This module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. The connector fails to properly handle specially crafted HTTP POST requests, resulting a buffer overflow due to the insecure usage of sprintf. Currently, this module works over Windows systems without DEP, and h...

Trixbox langChoice PHP Local File Inclusion

This module injects php into the trixbox session file and then, in a second call, evaluates that code by manipulating the langChoice parameter as described in OSVDB-50421. Module Options msf use exploit/unix/webapp/trixbox/langchoice msf undefinedlangchoice show actions ...actions... msf...

Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system via the Microsoft Office Snapshot Viewer ActiveX Control. Module Options msf use exploit/windows/browser/ms08/041snapshotviewer msf undefined041snapshotviewer show actions ...actions... msf...

OpenTFTP SP 1.4 Error Packet Overflow

This module exploits a buffer overflow in OpenTFTP Server SP 1.4. The vulnerable condition triggers when the TFTP opcode is configured as an error packet, the TFTP service will then format the message using a sprintf function, which causes an overflow, therefore allowing remote code execution und...

Novell GroupWise Messenger Client Buffer Overflow

This module exploits a stack buffer overflow in Novell's GroupWise Messenger Client. By sending a specially crafted HTTP response, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/novell/groupwisemessenger/client msf undefinedclient show actions...

Windows Silent Process Exit Persistence

Windows allows you to set up a debug process when a process exits. This module uploads a payload and declares that it is the debug process to launch when a specified process exits. Module Options msf use exploit/windows/persistence/image/execoptions msf undefinedexecoptions show actions...

Novell Client 4.91 SP4 nwfs.sys Local Privilege Escalation

This module exploits a flaw in the nwfs.sys driver to overwrite data in kernel space. The corruption occurs while handling ioctl requests with code 0x1438BB, where a 0x00000009 dword is written to an arbitrary address. An entry within the HalDispatchTable is overwritten in order to execute...

VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow

The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. An attacker can exploit this issue to execute arbitrary code within the context of the affected...

Novell iPrint Client ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Novell iPrint Client 4.34. When sending an overly long string to the GetDriverSettings property of ienipp.ocx an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/novelliprint/getdriversettings msf...

Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include

This module exploits a remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier. Module Options msf use exploit/unix/webapp/mambo/cachelite msf undefinedcachelite show actions ...actions... msf undefinedcachelite set ACTION msf...

BASE base_qry_common Remote File Include

This module exploits a remote file inclusion vulnerability in the baseqrycommon.php file in BASE 1.2.4 and earlier. Module Options msf use exploit/unix/webapp/base/qrycommon msf undefinedqrycommon show actions ...actions... msf undefinedqrycommon set ACTION msf undefinedqrycommon show options...

CitectSCADA/CitectFacilities ODBC Buffer Overflow

This module exploits a stack buffer overflow in CitectSCADA's ODBC daemon. This has only been tested against Citect v5, v6 and v7. Module Options msf use exploit/windows/scada/citect/scadaodbc msf undefinedscadaodbc show actions ...actions... msf undefinedscadaodbc set ACTION msf undefinedscadaod...

Anonymous FTP Access Detection

Detect anonymous read/write FTP server access. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Anonymous FTP Access Detection', 'Description' = 'Detect anonymous read/write FTP server access.',...

VNC Authentication None Detection

Detect VNC servers that support the "None" authentication method. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VNC Authentication None Detection', 'Description' = 'Detect VNC servers that...

Black Ice Cover Page ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control BIImgFrm.ocx 12.0.0.0. Code execution can be achieved by first uploading the payload to the remote machine, and then uploa...

DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow

This module exploits a stack buffer overflow in the authentication mechanism of NSI Doubletake which is also rebranded as HP Storage Works. This vulnerability was found by Titon of Bastard Labs. Module Options msf use exploit/windows/misc/doubletake msf undefineddoubletake show actions...

Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute

This module exploits a vulnerability in Icona SpA C6 Messenger 1.0.0.1. The vulnerability is in the DownloaderActiveX Control DownloaderActiveX.ocx. The insecure control can be abused to download and execute arbitrary files in the context of the currently logged-on user. Module Options msf use...

Alt-N SecurityGateway username Buffer Overflow

Alt-N SecurityGateway is prone to a buffer overflow condition. This is due to insufficient bounds checking on the "username" parameter. Successful exploitation could result in code execution with SYSTEM level privileges. NOTE: This service doesn't restart, you'll only get one shot. However, it...

Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Creative Software AutoUpdate Engine. When sending an overly long string to the cachefolder property of CTSUEng.ocx an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/creative/softwarecachefolder msf...