Orbit Downloader URL Unicode Conversion Overflow

This module exploits a stack-based buffer overflow in Orbit Downloader. The vulnerability is due to Orbit converting a URL ascii string to unicode in an insecure way with MultiByteToWideChar. The vulnerability is exploited with a specially crafted metalink file that should be opened with Orbit...

Borland CaliberRM StarTeam Multicast Service Buffer Overflow

This module exploits a stack buffer overflow in Borland CaliberRM 2006. By sending a specially crafted GET request to the STMulticastService, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/borland/starteam msf undefinedstarteam show actions...

HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager versions 7.53 and earlier. Specifically this vulnerability is caused by a failure to properly handle user supplied input within the HTTP request including headers and the actual URL GET request. Exploitation is trick...

Wireshark LDAP Dissector DOS

The LDAP dissector in Wireshark 0.99.2 through 0.99.8 allows remote attackers to cause a denial of service application crash via a malformed packet. Module Options msf use auxiliary/dos/wireshark/ldap msf undefinedldap show actions ...actions... msf undefinedldap set ACTION msf undefinedldap show...

Quick FTP Pro 2.1 Transfer-Mode Overflow

This module exploits a stack buffer overflow in the Quick TFTP Pro server product. MS Update KB926436 screws up the opcode address being used in oledlg.dll resulting in a DoS. This is a port of a sploit by Mati "muts" Aharoni. Module Options msf use exploit/windows/tftp/quick/tftppromode msf...

TFTP Server for Windows 1.4 ST WRQ Buffer Overflow

This module exploits a vulnerability found in TFTP Server 1.4 ST. The flaw is due to the way TFTP handles the filename parameter extracted from a WRQ request. The server will append the user-supplied filename to TFTP server binary's path without any bounds checking, and then attempt to check this...

Asus Dpcproxy Buffer Overflow

This module exploits a stack buffer overflow in Asus Dpcroxy version 2.0.0.19. It should be vulnerable until version 2.0.0.24. Credit to Luigi Auriemma Module Options msf use exploit/windows/misc/asus/dpcproxyoverflow msf undefineddpcproxyoverflow show actions ...actions... msf...

CA BrightStor ARCserve Backup AddColumn() ActiveX Buffer Overflow

The CA BrightStor ARCserve Backup ActiveX control ListCtrl.ocx is vulnerable to a stack-based buffer overflow. By passing an overly long argument to the AddColumn method, a remote attacker could overflow a buffer and execute arbitrary code on the system. Module Options msf use...

MDaemon 9.6.4 IMAPD FETCH Buffer Overflow

This module exploits a stack buffer overflow in the Alt-N MDaemon IMAP Server version 9.6.4 by sending an overly long FETCH BODY command. Valid IMAP account credentials are required. Credit to Matteo Memelli Module Options msf use exploit/windows/imap/mdaemon/fetch msf undefinedfetch show actions...

Linux Chmod

Runs chmod on specified file with specified mode This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Linux Chmodfile, mode Kris Katterjohn - 03/03/2008 module MetasploitModule CachedSize = 36 include Msf::Payload::Single...

RealPlayer rmoc3260.dll ActiveX Control Heap Corruption

This module exploits a heap corruption vulnerability in the RealPlayer ActiveX control. By sending a specially crafted string to the 'Console' property in the rmoc3260.dll control, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/realplayer/console...

PHP Command Shell, Reverse TCP (via PHP)

Reverse PHP connect back shell with checks for disabled functions This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Php...

Authentication Capture: FTP

This module provides a fake FTP service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: FTP', 'Description' = %q...

Authentication Capture: IMAP

This module provides a fake IMAP service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: IMAP', 'Description' = %...

Authentication Capture: POP3

This module provides a fake POP3 service that is designed to capture authentication credentials. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Authentication Capture: POP3', 'Description' = %...

Symantec BackupExec Calendar Control Buffer Overflow

This module exploits a stack buffer overflow in Symantec BackupExec Calendar Control. By sending an overly long string to the "DOWText0" property located in the pvcalendar.ocx control, an attacker may be able to execute arbitrary code. Module Options msf use...

Novell iPrint Client ActiveX Control ExecuteRequest Buffer Overflow

This module exploits a stack buffer overflow in Novell iPrint Client 4.26. When sending an overly long string to the ExecuteRequest property of ienipp.ocx an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/novelliprint/executerequest msf...

Now SMS/MMS Gateway Buffer Overflow

This module exploits a stack buffer overflow in Now SMS/MMS Gateway v2007.06.27. By sending a specially crafted GET request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/nowsms msf undefinednowsms show actions ...actions... msf undefinednowsms set...

AtHocGov IWSAlerts ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in AtHocGov IWSAlerts. When sending an overly long string to the CompleteInstallation method of AtHocGovTBr.dll 6.1.4.36 an attacker may be able to execute arbitrary code. This vulnerability was silently patched by the vendor. Module Options msf use...

OS X Execute Command

Execute an arbitrary command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 24 include Msf::Payload::Single include Msf::Payload::Bsd::X86...

Adobe util.printf() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional use exploit/windows/fileformat/adobe/utilprintf msf undefinedutilprintf show actions ...actions... msf undefinedutilprintf set ACTION msf undefinedutilprintf show options ...show and set options... msf...

Adobe util.printf() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional use exploit/windows/browser/adobe/utilprintf msf undefinedutilprintf show actions ...actions... msf undefinedutilprintf set ACTION msf undefinedutilprintf show options ...show and set options... msf...

Adobe Collab.collectEmailInfo() Buffer Overflow

This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional 8.1.1. By creating a specially crafted pdf that a contains malformed Collab.collectEmailInfo call, an attacker may be able to execute arbitrary code. Module Options msf use...

UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow

This module exploits a buffer overflow in UltraVNC Viewer 1.0.2 Release. If a malicious server responds to a client connection indicating a minor protocol version of 14 or 16, a 32-bit integer is subsequently read from the TCP stream by the client and directly provided as the trusted size for...

WinComLPD Buffer Overflow

This module exploits a stack buffer overflow in WinComLPD use exploit/windows/lpd/wincomlpd/admin msf undefinedadmin show actions ...actions... msf undefinedadmin set ACTION msf undefinedadmin show options ...show and set options... msf undefinedadmin run This module requires Metasploit:...

SAP SAPLPD 6.28 Buffer Overflow

This module exploits a stack buffer overflow in SAPlpd 6.28 SAP Release 6.40 . By sending an overly long argument, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/lpd/saplpd msf undefinedsaplpd show actions ...actions... msf undefinedsaplpd set ACTION msf...

Facebook Photo Uploader 4 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Facebook Photo Uploader 4. By sending an overly long string to the "ExtractIptc" property located in the ImageUploader4.ocx 4.5.57.0 Control, an attacker may be able to execute arbitrary code. Module Options msf use...

Coppermine Photo Gallery picEditor.php Command Execution

This module exploits a vulnerability in the picEditor.php script of Coppermine Photo Gallery versions 1.4.14 and earlier. When configured to use the ImageMagick library, the 'quality', 'angle', and 'clipval' parameters are not properly escaped before being passed to the PHP 'exec' command. In ord...

NetWare Command Shell, Reverse TCP Stager

Connect to the NetWare console staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' module MetasploitModule CachedSize = 281 include Msf::Payload::Stager include...

TrendMicro ServerProtect File Access

This modules exploits a remote file access flaw in the ServerProtect Windows Server RPC service. Please see the action list or the help output for more information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework clas...

Persits XUpload ActiveX AddFile Buffer Overflow

This module exploits a stack buffer overflow in Persits Software Inc's XUpload ActiveX controlversion 3.0.0.3 thats included in HP LoadRunner 9.5. By passing an overly long string to the AddFile method, an attacker may be able to execute arbitrary code. Module Options msf use...

SMB Session Pipe DCERPC Auditor

Determine what DCERPC services are accessible over a SMB pipe This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB Session Pipe DCERPC Auditor', 'Description' = 'Determine what DCERPC services a...

Streamcast HTTP User-Agent Buffer Overflow

This module exploits a stack buffer overflow in Streamcast use exploit/windows/http/steamcast/useragent msf undefineduseragent show actions ...actions... msf undefineduseragent set ACTION msf undefineduseragent show options ...show and set options... msf undefineduseragent run This module require...

Winamp Ultravox Streaming Metadata (in_mp3.dll) Buffer Overflow

This module exploits a stack buffer overflow in Winamp 5.24. By sending an overly long artist tag, a remote attacker may be able to execute arbitrary code. This vulnerability can be exploited from the browser or the Winamp client itself. Module Options msf use...

SAP MaxDB cons.exe Remote Command Injection

SAP MaxDB is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input. Module Options msf use auxiliary/admin/maxdb/maxdb/consexec msf undefinedconsexec show actions ...actions... msf undefinedconsexec set ACTION msf undefinedconsexe...

XTACACSD report() Buffer Overflow

This module exploits a stack buffer overflow in XTACACSD use exploit/freebsd/tacacs/xtacacsd/report msf undefinedreport show actions ...actions... msf undefinedreport set ACTION msf undefinedreport show options ...show and set options... msf undefinedreport run This module requires Metasploit:...

Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_GRANTED_XML

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMSMETADATA.GETGRANTEDXML package/function. Module Options msf use auxiliary/sqli/oracle/dbms/metadatagetgrantedxml msf undefinedmetadatagetgrantedxml show actions ...actions... msf...

Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_XML

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMSMETADATA.GETXML package/function. Module Options msf use auxiliary/sqli/oracle/dbms/metadatagetxml msf undefinedmetadatagetxml show actions ...actions... msf undefinedmetadatagetxml set ACTION msf...

Oracle DB SQL Injection via SYS.DBMS_METADATA.OPEN

This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in the SYS.DBMSMETADATA.OPEN package/function. Module Options msf use auxiliary/sqli/oracle/dbms/metadataopen msf undefinedmetadataopen show actions ...actions... msf undefinedmetadataopen set ACTION msf...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL use exploit/linux/mysql/mysql/yasslhello msf undefinedyasslhello show actions ...actions... msf undefinedyasslhello set ACTION msf undefinedyasslhello show options ...show and set...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL use exploit/windows/mysql/mysql/yasslhello msf undefinedyasslhello show actions ...actions... msf undefinedyasslhello set ACTION msf undefinedyasslhello show options ...show and set...

HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow

This module exploits a stack buffer overflow in Persits Software Inc's XUpload ActiveX controlversion 2.1.0.1 thats included in HP LoadRunner 9.0. By passing an overly long string to the AddFolder method, an attacker may be able to execute arbitrary code. Module Options msf use...

IBM Lotus Domino Web Access Upload Module Buffer Overflow

This module exploits a stack buffer overflow in IBM Lotus Domino Web Access Upload Module. By sending an overly long string to the "GeneralServerName" property located in the dwa7w.dll and the inotes6w.dll control, an attacker may be able to execute arbitrary code. Module Options msf use...

Appian Enterprise Business Suite 5.6 SP1 DoS

This module exploits a denial of service flaw in the Appian Enterprise Business Suite service. Module Options msf use auxiliary/dos/windows/appian/appian/bpm msf undefinedbpm show actions ...actions... msf undefinedbpm set ACTION msf undefinedbpm show options ...show and set options... msf...

Apple OS X Software Update Command Execution

This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means...

MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow

This module exploits a stack buffer overflow in the DirectShow Synchronized Accessible Media Interchanged SAMI parser in quartz.dll. This module has only been tested with Windows Media Player 6.4.09.1129 and DirectX 8.0. Module Options msf use exploit/windows/misc/ms07/064sami msf undefined064sam...

MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow

This module exploits a stack buffer overflow in the RPC interface to the Microsoft Message Queueing service. This exploit requires the target system to have been configured with a DNS name and for that name to be supplied in the 'DNAME' option. This name does not need to be served by a valid DNS...

BadBlue 2.72b PassThru Buffer Overflow

This module exploits a stack buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier. Module Options msf use exploit/windows/http/badblue/passthru msf undefinedpassthru show actions ...actions... msf undefinedpassthru set ACTION msf undefinedpassthru show options...

Oracle Java execCommand (Win32)

This module will create a java class which enables the execution of OS commands. Module Options msf use auxiliary/admin/oracle/post/exploitation/win32exec msf undefinedwin32exec show actions ...actions... msf undefinedwin32exec set ACTION msf undefinedwin32exec show options ...show and set...

Oracle SQL Generic Query

This module allows for simple SQL statements to be executed against an Oracle instance given the appropriate credentials and sid. Module Options msf use auxiliary/admin/oracle/oracle/sql msf undefinedsql show actions ...actions... msf undefinedsql set ACTION msf undefinedsql show options ...show...