XTACACSD report() Buffer Overflow

This module exploits a stack buffer overflow in XTACACSD use exploit/freebsd/tacacs/xtacacsd/report msf undefinedreport show actions ...actions... msf undefinedreport set ACTION msf undefinedreport show options ...show and set options... msf undefinedreport run This module requires Metasploit:...

Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_XML

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMSMETADATA.GETXML package/function. Module Options msf use auxiliary/sqli/oracle/dbms/metadatagetxml msf undefinedmetadatagetxml show actions ...actions... msf undefinedmetadatagetxml set ACTION msf...

Oracle DB SQL Injection via SYS.DBMS_METADATA.GET_GRANTED_XML

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMSMETADATA.GETGRANTEDXML package/function. Module Options msf use auxiliary/sqli/oracle/dbms/metadatagetgrantedxml msf undefinedmetadatagetgrantedxml show actions ...actions... msf...

Oracle DB SQL Injection via SYS.DBMS_METADATA.OPEN

This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in the SYS.DBMSMETADATA.OPEN package/function. Module Options msf use auxiliary/sqli/oracle/dbms/metadataopen msf undefinedmetadataopen show actions ...actions... msf undefinedmetadataopen set ACTION msf...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL use exploit/linux/mysql/mysql/yasslhello msf undefinedyasslhello show actions ...actions... msf undefinedyasslhello set ACTION msf undefinedyasslhello show options ...show and set...

MySQL yaSSL SSL Hello Message Buffer Overflow

This module exploits a stack buffer overflow in the yaSSL 1.7.5 and earlier implementation bundled with MySQL use exploit/windows/mysql/mysql/yasslhello msf undefinedyasslhello show actions ...actions... msf undefinedyasslhello set ACTION msf undefinedyasslhello show options ...show and set...

HP LoadRunner 9.0 ActiveX AddFolder Buffer Overflow

This module exploits a stack buffer overflow in Persits Software Inc's XUpload ActiveX controlversion 2.1.0.1 thats included in HP LoadRunner 9.0. By passing an overly long string to the AddFolder method, an attacker may be able to execute arbitrary code. Module Options msf use...

IBM Lotus Domino Web Access Upload Module Buffer Overflow

This module exploits a stack buffer overflow in IBM Lotus Domino Web Access Upload Module. By sending an overly long string to the "GeneralServerName" property located in the dwa7w.dll and the inotes6w.dll control, an attacker may be able to execute arbitrary code. Module Options msf use...

Appian Enterprise Business Suite 5.6 SP1 DoS

This module exploits a denial of service flaw in the Appian Enterprise Business Suite service. Module Options msf use auxiliary/dos/windows/appian/appian/bpm msf undefinedbpm show actions ...actions... msf undefinedbpm set ACTION msf undefinedbpm show options ...show and set options... msf...

Apple OS X Software Update Command Execution

This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means...

MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow

This module exploits a stack buffer overflow in the RPC interface to the Microsoft Message Queueing service. This exploit requires the target system to have been configured with a DNS name and for that name to be supplied in the 'DNAME' option. This name does not need to be served by a valid DNS...

MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow

This module exploits a stack buffer overflow in the DirectShow Synchronized Accessible Media Interchanged SAMI parser in quartz.dll. This module has only been tested with Windows Media Player 6.4.09.1129 and DirectX 8.0. Module Options msf use exploit/windows/misc/ms07/064sami msf undefined064sam...

BadBlue 2.72b PassThru Buffer Overflow

This module exploits a stack buffer overflow in the PassThru functionality in ext.dll in BadBlue 2.72b and earlier. Module Options msf use exploit/windows/http/badblue/passthru msf undefinedpassthru show actions ...actions... msf undefinedpassthru set ACTION msf undefinedpassthru show options...

Oracle SQL Generic Query

This module allows for simple SQL statements to be executed against an Oracle instance given the appropriate credentials and sid. Module Options msf use auxiliary/admin/oracle/oracle/sql msf undefinedsql show actions ...actions... msf undefinedsql set ACTION msf undefinedsql show options ...show...

Oracle Java execCommand (Win32)

This module will create a java class which enables the execution of OS commands. Module Options msf use auxiliary/admin/oracle/post/exploitation/win32exec msf undefinedwin32exec show actions ...actions... msf undefinedwin32exec set ACTION msf undefinedwin32exec show options ...show and set...

HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50. By sending a specially crafted CGI request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/hp/nnmopenview5 msf undefinednnmopenview5 show actions ...actions... ms...

ACDSee XPM File Section Buffer Overflow

This module exploits a buffer overflow in ACDSee 9.0. When viewing a malicious XPM file with the ACDSee product, a remote attacker could overflow a buffer and execute arbitrary code. Module Options msf use exploit/windows/fileformat/acdsee/xpm msf undefinedxpm show actions ...actions... msf...

Apple QuickTime 7.3 RTSP Response Header Buffer Overflow

This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/apple/quicktimertspresponse msf undefinedquicktimertspresponse show actions...

MacOS X QuickTime RTSP Content-Type Overflow

This module exploits a stack-based buffer overflow in Apple QuickTime before version 7.3.1. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code. Module Options msf use exploit/osx/rtsp/quicktime/rtspcontenttype msf undefinedrtspcontenttype show...

WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow

The FileView ActiveX control WZFILEVIEW.FileViewCtrl.61 could allow a remote attacker to execute arbitrary code on the system. The control contains several unsafe methods and is marked safe for scripting and safe for initialization. A remote attacker could exploit this vulnerability to execute...

SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SonicWall SSL-VPN NetExtender. By sending an overly long string to the "AddRouteEntry" method located in the NELaunchX.dll 1.0.0.26 Control, an attacker may be able to execute arbitrary code. Module Options msf use...

Macrovision InstallShield Update Service Buffer Overflow

This module exploits a stack buffer overflow in Macrovision InstallShield Update ServiceIsusweb.dll 6.0.100.54472. By passing an overly long ProductCode string to the DownloadAndExecute method, an attacker may be able to execute arbitrary code. Module Options msf use...

GOM Player ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in GOM Player 2.1.6.3499. By sending an overly long string to the "OpenUrl" method located in the GomWeb3.dll Control, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/gom/openurl msf undefinedopenurl sh...

Macrovision InstallShield Update Service ActiveX Unsafe Method

This module allows attackers to execute code via an unsafe method in Macrovision InstallShield 2008. Module Options msf use exploit/windows/browser/macrovision/unsafe msf undefinedunsafe show actions ...actions... msf undefinedunsafe set ACTION msf undefinedunsafe show options ...show and set...

OS X Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- OSX reverse TCP stager. module MetasploitModule CachedSize = 184 include...

OS X Write and Execute Binary, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- OSX bind TCP stager. module MetasploitModule CachedSize = 248 include Msf::Payload::Stager def...

OS X Command Shell, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- OSX bind TCP stager. module MetasploitModule CachedSize = 248 include Msf::Payload::Stager def...

OS X Write and Execute Binary, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- OSX reverse TCP stager. module MetasploitModule CachedSize = 184 include...

RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow

This module exploits a stack buffer overflow in RealOne Player V2 Gold Build 6.0.11.853 and RealPlayer 10.5 Build 6.0.12.1483. By sending an overly long string to the "Import" method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/realplayer/impo...

Oracle DB SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.LT.FINDRICSET package via Evil Cursor technique. Tested on oracle 10.1.0.3.0 -- should work on thru 10.1.0.5.0 and supposedly on 11g. Fixed with Oracle Critical Patch update October 2007. Module Option...

TikiWiki tiki-graph_formula Remote PHP Code Execution

TikiWiki use exploit/unix/webapp/tikiwiki/graphformulaexec msf undefinedgraphformulaexec show actions ...actions... msf undefinedgraphformulaexec set ACTION msf undefinedgraphformulaexec show options ...show and set options... msf undefinedgraphformulaexec run This module requires Metasploit:...

Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Electronic Arts SnoopyCtrl ActiveX Control NPSnpy.dll 1.1.0.36. When sending an overly long string to the CheckRequirements method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/ea/checkrequirement...

Borland InterBase Services Manager Information

This module retrieves version of the services manager, version and implementation of the InterBase server from InterBase Services Manager. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Borlan...

HPLIP hpssd.py From Address Arbitrary Command Execution

This module exploits a command execution vulnerable in the hpssd.py daemon of the Hewlett-Packard Linux Imaging and Printing Project. According to MITRE, versions 1.x and 2.x before 2.7.10 are vulnerable. This module was written and tested using the Fedora 6 Linux distribution. On the test system...

Borland InterBase isc_attach_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. Module Options msf use exploit/windows/misc/ib/iscattachdatabase msf undefinediscattachdatabase show actions ...actions... msf undefinediscattachdatabase set ACTION msf...

Borland InterBase isc_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/windows/misc/ib/isccreatedatabase msf undefinedisccreatedatabase show actions ...actions... msf undefinedisccreatedatabase set ACTION msf...

Borland InterBase SVC_attach() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted service attach request. Module Options msf use exploit/windows/misc/ib/svcattach msf undefinedsvcattach show actions ...actions... msf undefinedsvcattach set ACTION msf undefinedsvcattach show options...

Firebird Relational Database SVC_attach() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted service attach request. Module Options msf use exploit/windows/misc/fb/svcattach msf undefinedsvcattach show actions ...actions... msf undefinedsvcattach set ACTION msf undefinedsvcattach show options...

Kazaa Altnet Download Manager ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Altnet Download Manager ActiveX Control amd4.dll bundled with Kazaa Media Desktop 3.2.7. By sending an overly long string to the "Install" method, an attacker may be able to execute arbitrary code. Module Options msf use...

Firebird Relational Database isc_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/windows/misc/fb/isccreatedatabase msf undefinedisccreatedatabase show actions ...actions... msf undefinedisccreatedatabase set ACTION msf...

Borland InterBase INET_connect() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted service attach request. Module Options msf use exploit/linux/misc/ib/inetconnect msf undefinedinetconnect show actions ...actions... msf undefinedinetconnect set ACTION msf undefinedinetconnect show...

Firebird Relational Database isc_attach_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/windows/misc/fb/iscattachdatabase msf undefinediscattachdatabase show actions ...actions... msf undefinediscattachdatabase set ACTION msf...

Borland InterBase PWD_db_aliased() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. Module Options msf use exploit/linux/misc/ib/pwddbaliased msf undefinedpwddbaliased show actions ...actions... msf undefinedpwddbaliased set ACTION msf undefinedpwddbaliased show optio...

Borland InterBase open_marker_file() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. Module Options msf use exploit/linux/misc/ib/openmarkerfile msf undefinedopenmarkerfile show actions ...actions... msf undefinedopenmarkerfile set ACTION msf undefinedopenmarkerfile sh...

Borland InterBase jrd8_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/linux/misc/ib/jrd8createdatabase msf undefinedjrd8createdatabase show actions ...actions... msf undefinedjrd8createdatabase set ACTION msf...

CA BrightStor HSM Buffer Overflow

This module exploits one of the multiple stack buffer overflows in Computer Associates BrightStor HSM. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/hsmserver msf undefinedhsmserver show...

Apple iOS iPhone Vibrate

Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded. Based on work by Charlie Miller . This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 16 include...

Apple iOS Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 200 include Msf::Payload::Single include Msf::Payload::Osx include...

Simple

Simple NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements simple NOP generator for ARM little endian class MetasploitModule 'Simple', 'Alias' = 'armlesimple',...

Apple iOS Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Payload::Osx include...