Windows Command Shell, Reverse TCP Stager (No NX or Win7)

Spawn a piped command shell staged. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 177 include Msf::Payload::Stager include Msf::Payload::Window...

Windows Meterpreter (skape/jt Injection), Bind TCP Stager (No NX or Win7)

Inject the meterpreter server DLL staged. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 201 include Msf::Payload::Stager include Msf::Payload::Windo...

Windows Meterpreter (Reflective Injection), Bind TCP Stager (No NX or Win7)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Listen for a connection No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModul...

Windows Meterpreter (Reflective Injection), Reverse TCP Stager (No NX or Win7)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker No NX This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module...

Microsoft Visual Studio Mdmask32.ocx ActiveX Stack Buffer Overflow

This module exploits a stack buffer overflow in Microsoft Visual Studio 6.0. When passing a specially crafted string to the Mask parameter of the Mdmask32.ocx ActiveX Control, an attacker may be able to execute arbitrary code. Module Options msf use...

Racer v0.5.3 Beta 5 Buffer Overflow

This module exploits the Racer Car and Racing Simulator game versions v0.5.3 beta 5 and earlier. Both the client and server listen on UDP port 26000. By sending an overly long buffer we are able to execute arbitrary code remotely. Module Options msf use exploit/windows/games/racer/503beta5 msf...

Ruby WEBrick::HTTP::DefaultFileHandler DoS

The WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 to 1.8.6-p286, 1.8.7 to 1.8.7-p71, and 1.9 to r18423 allows for a DoS CPU consumption via a crafted HTTP request. Module Options msf use auxiliary/dos/http/webrick/regex msf undefinedregex show actions ...actions...

WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow

This module exploits a stack-based buffer overflow in WebEx's WebexUCFObject ActiveX Control. If a long string is passed to the 'NewObject' method, a stack- based buffer overflow will occur when copying attacker-supplied data using the sprintf function. It is noteworthy that this vulnerability wa...

McAfee Remediation Client ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in McAfee Remediation Agent 4.5.0.41. When sending an overly long string to the DeleteSnapshot method of enginecom.dll 3.7.0.9 an attacker may be able to execute arbitrary code. This control is not marked safe for scripting, so choose your attack vecto...

DNS Spoofing Helper Service

This module provides a DNS service that returns TXT records indicating information about the querying service. Based on Dino Dai Zovi DNS code from Karma. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'resol...

DNS Lookup Result Comparison

This module can be used to determine differences in the cache entries between two DNS servers. This is primarily useful for detecting cache poisoning attacks, but can also be used to detect geo-location load balancing. Module Options msf use auxiliary/spoof/dns/compare/results msf undefinedresult...

DNS BailiWicked Domain Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit replaces the target domains nameserver entries in a vulnerable DNS cache server. This attack works by sending random hostname queries to the target DNS server coupled...

DNS BailiWicked Host Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random hostname queries to the target DNS server coupled with spoofed replies to those...

Oracle Weblogic Apache Connector POST Request Buffer Overflow

This module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. The connector fails to properly handle specially crafted HTTP POST requests, resulting a buffer overflow due to the insecure usage of sprintf. Currently, this module works over Windows systems without DEP, and h...

Trixbox langChoice PHP Local File Inclusion

This module injects php into the trixbox session file and then, in a second call, evaluates that code by manipulating the langChoice parameter as described in OSVDB-50421. Module Options msf use exploit/unix/webapp/trixbox/langchoice msf undefinedlangchoice show actions ...actions... msf...

Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system via the Microsoft Office Snapshot Viewer ActiveX Control. Module Options msf use exploit/windows/browser/ms08/041snapshotviewer msf undefined041snapshotviewer show actions ...actions... msf...

OpenTFTP SP 1.4 Error Packet Overflow

This module exploits a buffer overflow in OpenTFTP Server SP 1.4. The vulnerable condition triggers when the TFTP opcode is configured as an error packet, the TFTP service will then format the message using a sprintf function, which causes an overflow, therefore allowing remote code execution und...

Novell GroupWise Messenger Client Buffer Overflow

This module exploits a stack buffer overflow in Novell's GroupWise Messenger Client. By sending a specially crafted HTTP response, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/novell/groupwisemessenger/client msf undefinedclient show actions...

Windows Silent Process Exit Persistence

Windows allows you to set up a debug process when a process exits. This module uploads a payload and declares that it is the debug process to launch when a specified process exits. Module Options msf use exploit/windows/persistence/image/execoptions msf undefinedexecoptions show actions...

Novell Client 4.91 SP4 nwfs.sys Local Privilege Escalation

This module exploits a flaw in the nwfs.sys driver to overwrite data in kernel space. The corruption occurs while handling ioctl requests with code 0x1438BB, where a 0x00000009 dword is written to an arbitrary address. An entry within the HalDispatchTable is overwritten in order to execute...

Novell iPrint Client ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Novell iPrint Client 4.34. When sending an overly long string to the GetDriverSettings property of ienipp.ocx an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/novelliprint/getdriversettings msf...

VeryPDF PDFView OCX ActiveX OpenPDF Heap Overflow

The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer. An attacker can exploit this issue to execute arbitrary code within the context of the affected...

BASE base_qry_common Remote File Include

This module exploits a remote file inclusion vulnerability in the baseqrycommon.php file in BASE 1.2.4 and earlier. Module Options msf use exploit/unix/webapp/base/qrycommon msf undefinedqrycommon show actions ...actions... msf undefinedqrycommon set ACTION msf undefinedqrycommon show options...

Mambo Cache_Lite Class mosConfig_absolute_path Remote File Include

This module exploits a remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the CacheLite package in Mambo 4.6.4 and earlier. Module Options msf use exploit/unix/webapp/mambo/cachelite msf undefinedcachelite show actions ...actions... msf undefinedcachelite set ACTION msf...

CitectSCADA/CitectFacilities ODBC Buffer Overflow

This module exploits a stack buffer overflow in CitectSCADA's ODBC daemon. This has only been tested against Citect v5, v6 and v7. Module Options msf use exploit/windows/scada/citect/scadaodbc msf undefinedscadaodbc show actions ...actions... msf undefinedscadaodbc set ACTION msf undefinedscadaod...

Anonymous FTP Access Detection

Detect anonymous read/write FTP server access. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Anonymous FTP Access Detection', 'Description' = 'Detect anonymous read/write FTP server access.',...

VNC Authentication None Detection

Detect VNC servers that support the "None" authentication method. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VNC Authentication None Detection', 'Description' = 'Detect VNC servers that...

Black Ice Cover Page ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system by abusing the "DownloadImageFileURL" method in the Black Ice BIImgFrm.ocx ActiveX Control BIImgFrm.ocx 12.0.0.0. Code execution can be achieved by first uploading the payload to the remote machine, and then uploa...

DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow

This module exploits a stack buffer overflow in the authentication mechanism of NSI Doubletake which is also rebranded as HP Storage Works. This vulnerability was found by Titon of Bastard Labs. Module Options msf use exploit/windows/misc/doubletake msf undefineddoubletake show actions...

Icona SpA C6 Messenger DownloaderActiveX Control Arbitrary File Download and Execute

This module exploits a vulnerability in Icona SpA C6 Messenger 1.0.0.1. The vulnerability is in the DownloaderActiveX Control DownloaderActiveX.ocx. The insecure control can be abused to download and execute arbitrary files in the context of the currently logged-on user. Module Options msf use...

Alt-N SecurityGateway username Buffer Overflow

Alt-N SecurityGateway is prone to a buffer overflow condition. This is due to insufficient bounds checking on the "username" parameter. Successful exploitation could result in code execution with SYSTEM level privileges. NOTE: This service doesn't restart, you'll only get one shot. However, it...

Creative Software AutoUpdate Engine ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Creative Software AutoUpdate Engine. When sending an overly long string to the cachefolder property of CTSUEng.ocx an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/creative/softwarecachefolder msf...

EMC AlphaStor Device Manager Arbitrary Command Execution

EMC AlphaStor Device Manager is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/emc/alphastor/devicemanagerexec msf undefineddevicemanagerexec show actions ...actions... msf...

EMC AlphaStor Library Manager Arbitrary Command Execution

EMC AlphaStor Library Manager is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/emc/alphastor/librarymanagerexec msf undefinedlibrarymanagerexec show actions ...actions... msf...

EMC AlphaStor Agent Buffer Overflow

This module exploits a stack buffer overflow in EMC AlphaStor 3.1. By sending a specially crafted message, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/emc/alphastor/agent msf undefinedagent show actions ...actions... msf undefinedagent set ACTION msf...

IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow

This module exploits a stack buffer overflow in Lotus Domino's Sametime Server. By sending an overly long POST request to the Multiplexer STMux.exe service we are able to overwrite SEH. Based on the exploit by Manuel Santamarina Suarez. Module Options msf use...

IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow

This module exploits a stack buffer overflow in IBM Lotus Domino Web Server prior to version 7.0.3FP1 and 8.0.1. This flaw is triggered by any HTTP request with an Accept-Language header greater than 114 bytes. Module Options msf use exploit/windows/lotus/domino/httpacceptlanguage msf...

Windows Command, Generic Command Execution

Executes the supplied command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 8 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo =...

Symantec Altiris DS SQL Injection

This module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8 to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize numeric input fields in "UpdateComputer" notification Requests. In order to spawn a shell, several SQL injections are...

Timbuktu Pro Directory Traversal/File Upload

This module exploits a directory traversal vulnerability in Motorola's Timbuktu Pro for Windows 8.6.5. Module Options msf use exploit/windows/motorola/timbuktu/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options...

Solaris ypupdated Command Execution

This exploit targets a weakness in the way the ypupdated RPC application uses the command shell when handling a MAP UPDATE request. Extra commands may be launched through this command shell, which runs as root on the remote host, by passing commands in the format '|'. Vulnerable systems include...

OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow

This module exploits a vulnerability in OpenOffice 2.3.1 and 2.3.0 on Microsoft Windows XP SP3. By supplying a OLE file with a malformed DocumentSummaryInformation stream, an attacker can gain control of the execution flow, which results arbitrary code execution under the context of the user...

BigAnt Server 2.2 Buffer Overflow

This module exploits a stack buffer overflow in BigAnt Server 2.2. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/bigant/server msf undefinedserver show actions ...actions... msf undefinedserver set ACTION msf...

BigAnt Server 2.50 SP1 Buffer Overflow

This exploits a stack buffer overflow in the BigAnt Messaging Service, part of the BigAnt Server product suite. This module was tested successfully against version 2.50 SP1. Module Options msf use exploit/windows/misc/bigant/server250 msf undefinedserver250 show actions ...actions... msf...

Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the vcsteu.dll FileTransfer Module 1.0.0.5 ActiveX control in the Tumbleweed SecureTransport suite. By sending an overly long string to the TransferFile 'remotefile' function, an attacker may be able to execute arbitrary code. Module Options msf use...

Computer Associates Alert Notification Buffer Overflow

This module exploits a buffer overflow in Computer Associates Threat Manager for the Enterprise r8.1 By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. In order to successfully exploit this vulnerability, you will need valid logon...

Windows Command Shell, Bind TCP (via Perl)

Listen for a connection and spawn a command shell via perl persistent This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 139 include Msf::Payload::Single include...

Windows Command, Double Reverse TCP Connection (via Perl)

Creates an interactive shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 148 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo...

Orbit Downloader URL Unicode Conversion Overflow

This module exploits a stack-based buffer overflow in Orbit Downloader. The vulnerability is due to Orbit converting a URL ascii string to unicode in an insecure way with MultiByteToWideChar. The vulnerability is exploited with a specially crafted metalink file that should be opened with Orbit...

Borland CaliberRM StarTeam Multicast Service Buffer Overflow

This module exploits a stack buffer overflow in Borland CaliberRM 2006. By sending a specially crafted GET request to the STMulticastService, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/borland/starteam msf undefinedstarteam show actions...