EMC AlphaStor Agent Buffer Overflow

This module exploits a stack buffer overflow in EMC AlphaStor 3.1. By sending a specially crafted message, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/emc/alphastor/agent msf undefinedagent show actions ...actions... msf undefinedagent set ACTION msf...

EMC AlphaStor Device Manager Arbitrary Command Execution

EMC AlphaStor Device Manager is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/emc/alphastor/devicemanagerexec msf undefineddevicemanagerexec show actions ...actions... msf...

EMC AlphaStor Library Manager Arbitrary Command Execution

EMC AlphaStor Library Manager is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/emc/alphastor/librarymanagerexec msf undefinedlibrarymanagerexec show actions ...actions... msf...

IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow

This module exploits a stack buffer overflow in Lotus Domino's Sametime Server. By sending an overly long POST request to the Multiplexer STMux.exe service we are able to overwrite SEH. Based on the exploit by Manuel Santamarina Suarez. Module Options msf use...

IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow

This module exploits a stack buffer overflow in IBM Lotus Domino Web Server prior to version 7.0.3FP1 and 8.0.1. This flaw is triggered by any HTTP request with an Accept-Language header greater than 114 bytes. Module Options msf use exploit/windows/lotus/domino/httpacceptlanguage msf...

Windows Command, Generic Command Execution

Executes the supplied command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 8 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo =...

Symantec Altiris DS SQL Injection

This module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8 to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize numeric input fields in "UpdateComputer" notification Requests. In order to spawn a shell, several SQL injections are...

Timbuktu Pro Directory Traversal/File Upload

This module exploits a directory traversal vulnerability in Motorola's Timbuktu Pro for Windows 8.6.5. Module Options msf use exploit/windows/motorola/timbuktu/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options...

OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow

This module exploits a vulnerability in OpenOffice 2.3.1 and 2.3.0 on Microsoft Windows XP SP3. By supplying a OLE file with a malformed DocumentSummaryInformation stream, an attacker can gain control of the execution flow, which results arbitrary code execution under the context of the user...

BigAnt Server 2.50 SP1 Buffer Overflow

This exploits a stack buffer overflow in the BigAnt Messaging Service, part of the BigAnt Server product suite. This module was tested successfully against version 2.50 SP1. Module Options msf use exploit/windows/misc/bigant/server250 msf undefinedserver250 show actions ...actions... msf...

BigAnt Server 2.2 Buffer Overflow

This module exploits a stack buffer overflow in BigAnt Server 2.2. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/bigant/server msf undefinedserver show actions ...actions... msf undefinedserver set ACTION msf...

Tumbleweed FileTransfer vcst_eu.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the vcsteu.dll FileTransfer Module 1.0.0.5 ActiveX control in the Tumbleweed SecureTransport suite. By sending an overly long string to the TransferFile 'remotefile' function, an attacker may be able to execute arbitrary code. Module Options msf use...

Computer Associates Alert Notification Buffer Overflow

This module exploits a buffer overflow in Computer Associates Threat Manager for the Enterprise r8.1 By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. In order to successfully exploit this vulnerability, you will need valid logon...

Windows Command, Double Reverse TCP Connection (via Perl)

Creates an interactive shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 148 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo...

Windows Command Shell, Bind TCP (via Perl)

Listen for a connection and spawn a command shell via perl persistent This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 139 include Msf::Payload::Single include...

Orbit Downloader URL Unicode Conversion Overflow

This module exploits a stack-based buffer overflow in Orbit Downloader. The vulnerability is due to Orbit converting a URL ascii string to unicode in an insecure way with MultiByteToWideChar. The vulnerability is exploited with a specially crafted metalink file that should be opened with Orbit...

HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager versions 7.53 and earlier. Specifically this vulnerability is caused by a failure to properly handle user supplied input within the HTTP request including headers and the actual URL GET request. Exploitation is trick...

Borland CaliberRM StarTeam Multicast Service Buffer Overflow

This module exploits a stack buffer overflow in Borland CaliberRM 2006. By sending a specially crafted GET request to the STMulticastService, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/borland/starteam msf undefinedstarteam show actions...

Wireshark LDAP Dissector DOS

The LDAP dissector in Wireshark 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service application crash via a malformed packet. Module Options msf use auxiliary/dos/wireshark/ldap msf undefinedldap show actions ...actions... msf undefinedldap set ACTION msf undefinedldap show...

Quick FTP Pro 2.1 Transfer-Mode Overflow

This module exploits a stack buffer overflow in the Quick TFTP Pro server product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting in a DoS. This is a port of a sploit by Mati "muts" Aharoni. Module Options msf use exploit/windows/tftp/quick/tftppromode msf...

TFTP Server for Windows 1.4 ST WRQ Buffer Overflow

This module exploits a vulnerability found in TFTP Server 1.4 ST. The flaw is due to the way TFTP handles the filename parameter extracted from a WRQ request. The server will append the user-supplied filename to TFTP server binary's path without any bounds checking, and then attempt to check this...

Asus Dpcproxy Buffer Overflow

This module exploits a stack buffer overflow in Asus Dpcroxy version 2.0.0.19. It should be vulnerable until version 2.0.0.24. Credit to Luigi Auriemma Module Options msf use exploit/windows/misc/asus/dpcproxyoverflow msf undefineddpcproxyoverflow show actions ...actions... msf...

CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow

The CA BrightStor ARCserve Backup ActiveX control ListCtrl.ocx is vulnerable to a stack-based buffer overflow. By passing an overly long argument to the AddColumn method, a remote attacker could overflow a buffer and execute arbitrary code on the system. Module Options msf use...

MDaemon 9.6.4 IMAPD FETCH Buffer Overflow

This module exploits a stack buffer overflow in the Alt-N MDaemon IMAP Server version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP account credentials are required. Credit to Matteo Memelli Module Options msf use exploit/windows/imap/mdaemon/fetch msf undefinedfetch show actions...

Linux Chmod

Runs chmod on specified file with specified mode This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Linux Chmodfile, mode Kris Katterjohn - 03/03/2008 module MetasploitModule CachedSize = 36 include Msf::Payload::Single...

RealPlayer rmoc3260.dll ActiveX Control Heap Corruption

This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control. By sending a specially crafted string to the 'Console' property in the rmoc3260.dll control, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/realplayer/console...

PHP Command Shell, Reverse TCP (via PHP)

Reverse PHP connect back shell with checks for disabled functions This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Php...

Authentication Capture: POP3

This module provides a fake POP3 service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: POP3', 'Description' = %...

Authentication Capture: FTP

This module provides a fake FTP service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: FTP', 'Description' = %q...

Authentication Capture: IMAP

This module provides a fake IMAP service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: IMAP', 'Description' = %...

Symantec BackupExec Calendar Control Buffer Overflow

This module exploits a stack buffer overflow in Symantec BackupExec Calendar Control. By sending an overly long string to the "DOWText0" property located in the pvcalendar.ocx control, an attacker may be able to execute arbitrary code. Module Options msf use...

Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow

This module exploits a stack buffer overflow in Novell iPrint Client 4.26. When sending an overly long string to the ExecuteRequest property of ienipp.ocx an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/novelliprint/executerequest msf...

Now SMS/MMS Gateway Buffer Overflow

This module exploits a stack buffer overflow in Now SMS/MMS Gateway v2007.06.27. By sending a specially crafted GET request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/nowsms msf undefinednowsms show actions ...actions... msf undefinednowsms set...

AtHocGov IWSAlerts ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in AtHocGov IWSAlerts. When sending an overly long string to the CompleteInstallation method of AtHocGovTBr.dll 6.1.4.36 an attacker may be able to execute arbitrary code. This vulnerability was silently patched by the vendor. Module Options msf use...

OS X Execute Command

Execute an arbitrary command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 24 include Msf::Payload::Single include Msf::Payload::Bsd::X86...

Adobe util.printf() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional use exploit/windows/browser/adobe/utilprintf msf undefinedutilprintf show actions ...actions... msf undefinedutilprintf set ACTION msf undefinedutilprintf show options ...show and set options... msf...

Adobe Collab.collectEmailInfo() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional 8.1.1. By creating a specially crafted pdf that a contains malformed Collab.collectEmailInfo call, an attacker may be able to execute arbitrary code. Module Options msf use...

Adobe util.printf() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional use exploit/windows/fileformat/adobe/utilprintf msf undefinedutilprintf show actions ...actions... msf undefinedutilprintf set ACTION msf undefinedutilprintf show options ...show and set options... msf...

UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow

This module exploits a buffer overflow in UltraVNC Viewer 1.0.2 Release. If a malicious server responds to a client connection indicating a minor protocol version of 14 or 16, a 32-bit integer is subsequently read from the TCP stream by the client and directly provided as the trusted size for...

WinComLPD Buffer Overflow

This module exploits a stack buffer overflow in WinComLPD use exploit/windows/lpd/wincomlpd/admin msf undefinedadmin show actions ...actions... msf undefinedadmin set ACTION msf undefinedadmin show options ...show and set options... msf undefinedadmin run This module requires Metasploit:...

SAP SAPLPD 6.28 Buffer Overflow

This module exploits a stack buffer overflow in SAPlpd 6.28 SAP Release 6.40 . By sending an overly long argument, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/lpd/saplpd msf undefinedsaplpd show actions ...actions... msf undefinedsaplpd set ACTION msf...

Facebook Photo Uploader 4 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Facebook Photo Uploader 4. By sending an overly long string to the "ExtractIptc" property located in the ImageUploader4.ocx 4.5.57.0 Control, an attacker may be able to execute arbitrary code. Module Options msf use...

Coppermine Photo Gallery picEditor.php Command Execution

This module exploits a vulnerability in the picEditor.php script of Coppermine Photo Gallery versions 1.4.14 and earlier. When configured to use the ImageMagick library, the 'quality', 'angle', and 'clipval' parameters are not properly escaped before being passed to the PHP 'exec' command. In ord...

NetWare Command Shell, Reverse TCP Stager

Connect to the NetWare console staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' module MetasploitModule CachedSize = 281 include Msf::Payload::Stager include...

TrendMicro ServerProtect File Access

This modules exploits a remote file access flaw in the ServerProtect Windows Server RPC service. Please see the action list or the help output for more information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework clas...

Persits XUpload ActiveX AddFile Buffer Overflow

This module exploits a stack buffer overflow in Persits Software Inc's XUpload ActiveX controlversion 3.0.0.3 thats included in HP LoadRunner 9.5. By passing an overly long string to the AddFile method, an attacker may be able to execute arbitrary code. Module Options msf use...

SMB Session Pipe DCERPC Auditor

Determine what DCERPC services are accessible over a SMB pipe This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Session Pipe DCERPC Auditor', 'Description' = 'Determine what DCERPC services a...

Streamcast HTTP User-Agent Buffer Overflow

This module exploits a stack buffer overflow in Streamcast use exploit/windows/http/steamcast/useragent msf undefineduseragent show actions ...actions... msf undefineduseragent set ACTION msf undefineduseragent show options ...show and set options... msf undefineduseragent run This module require...

Winamp Ultravox Streaming Metadata (in_mp3.dll) Buffer Overflow

This module exploits a stack buffer overflow in Winamp 5.24. By sending an overly long artist tag, a remote attacker may be able to execute arbitrary code. This vulnerability can be exploited from the browser or the Winamp client itself. Module Options msf use...

SAP MaxDB cons.exe Remote Command Injection

SAP MaxDB is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/maxdb/maxdb/consexec msf undefinedconsexec show actions ...actions... msf undefinedconsexec set ACTION msf undefinedconsexe...