Apple QuickTime 7.3 RTSP Response Header Buffer Overflow

This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long RTSP response to a client, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/apple/quicktimertspresponse msf undefinedquicktimertspresponse show actions...

ACDSee XPM File Section Buffer Overflow

This module exploits a buffer overflow in ACDSee 9.0. When viewing a malicious XPM file with the ACDSee product, a remote attacker could overflow a buffer and execute arbitrary code. Module Options msf use exploit/windows/fileformat/acdsee/xpm msf undefinedxpm show actions ...actions... msf...

WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow

The FileView ActiveX control WZFILEVIEW.FileViewCtrl.61 could allow a remote attacker to execute arbitrary code on the system. The control contains several unsafe methods and is marked safe for scripting and safe for initialization. A remote attacker could exploit this vulnerability to execute...

SonicWall SSL-VPN NetExtender ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SonicWall SSL-VPN NetExtender. By sending an overly long string to the "AddRouteEntry" method located in the NELaunchX.dll 1.0.0.26 Control, an attacker may be able to execute arbitrary code. Module Options msf use...

Macrovision InstallShield Update Service Buffer Overflow

This module exploits a stack buffer overflow in Macrovision InstallShield Update ServiceIsusweb.dll 6.0.100.54472. By passing an overly long ProductCode string to the DownloadAndExecute method, an attacker may be able to execute arbitrary code. Module Options msf use...

GOM Player ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in GOM Player 2.1.6.3499. By sending an overly long string to the "OpenUrl" method located in the GomWeb3.dll Control, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/gom/openurl msf undefinedopenurl sh...

Macrovision InstallShield Update Service ActiveX Unsafe Method

This module allows attackers to execute code via an unsafe method in Macrovision InstallShield 2008. Module Options msf use exploit/windows/browser/macrovision/unsafe msf undefinedunsafe show actions ...actions... msf undefinedunsafe set ACTION msf undefinedunsafe show options ...show and set...

OS X Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- OSX reverse TCP stager. module MetasploitModule CachedSize = 184 include...

OS X Write and Execute Binary, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- OSX bind TCP stager. module MetasploitModule CachedSize = 248 include Msf::Payload::Stager def...

OS X Write and Execute Binary, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- OSX reverse TCP stager. module MetasploitModule CachedSize = 184 include...

OS X Command Shell, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- OSX bind TCP stager. module MetasploitModule CachedSize = 248 include Msf::Payload::Stager def...

RealPlayer ierpplug.dll ActiveX Control Playlist Name Buffer Overflow

This module exploits a stack buffer overflow in RealOne Player V2 Gold Build 6.0.11.853 and RealPlayer 10.5 Build 6.0.12.1483. By sending an overly long string to the "Import" method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/realplayer/impo...

Oracle DB SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.LT.FINDRICSET package via Evil Cursor technique. Tested on oracle 10.1.0.3.0 -- should work on thru 10.1.0.5.0 and supposedly on 11g. Fixed with Oracle Critical Patch update October 2007. Module Option...

TikiWiki tiki-graph_formula Remote PHP Code Execution

TikiWiki use exploit/unix/webapp/tikiwiki/graphformulaexec msf undefinedgraphformulaexec show actions ...actions... msf undefinedgraphformulaexec set ACTION msf undefinedgraphformulaexec show options ...show and set options... msf undefinedgraphformulaexec run This module requires Metasploit:...

Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Electronic Arts SnoopyCtrl ActiveX Control NPSnpy.dll 1.1.0.36. When sending an overly long string to the CheckRequirements method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/ea/checkrequirement...

Borland InterBase Services Manager Information

This module retrieves version of the services manager, version and implementation of the InterBase server from InterBase Services Manager. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Borlan...

HPLIP hpssd.py From Address Arbitrary Command Execution

This module exploits a command execution vulnerable in the hpssd.py daemon of the Hewlett-Packard Linux Imaging and Printing Project. According to MITRE, versions 1.x and 2.x before 2.7.10 are vulnerable. This module was written and tested using the Fedora 6 Linux distribution. On the test system...

Kazaa Altnet Download Manager ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Altnet Download Manager ActiveX Control amd4.dll bundled with Kazaa Media Desktop 3.2.7. By sending an overly long string to the "Install" method, an attacker may be able to execute arbitrary code. Module Options msf use...

Firebird Relational Database isc_attach_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/windows/misc/fb/iscattachdatabase msf undefinediscattachdatabase show actions ...actions... msf undefinediscattachdatabase set ACTION msf...

Borland InterBase isc_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/windows/misc/ib/isccreatedatabase msf undefinedisccreatedatabase show actions ...actions... msf undefinedisccreatedatabase set ACTION msf...

Borland InterBase PWD_db_aliased() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. Module Options msf use exploit/linux/misc/ib/pwddbaliased msf undefinedpwddbaliased show actions ...actions... msf undefinedpwddbaliased set ACTION msf undefinedpwddbaliased show optio...

Borland InterBase isc_attach_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. Module Options msf use exploit/windows/misc/ib/iscattachdatabase msf undefinediscattachdatabase show actions ...actions... msf undefinediscattachdatabase set ACTION msf...

Borland InterBase SVC_attach() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted service attach request. Module Options msf use exploit/windows/misc/ib/svcattach msf undefinedsvcattach show actions ...actions... msf undefinedsvcattach set ACTION msf undefinedsvcattach show options...

Firebird Relational Database SVC_attach() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted service attach request. Module Options msf use exploit/windows/misc/fb/svcattach msf undefinedsvcattach show actions ...actions... msf undefinedsvcattach set ACTION msf undefinedsvcattach show options...

Borland InterBase INET_connect() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted service attach request. Module Options msf use exploit/linux/misc/ib/inetconnect msf undefinedinetconnect show actions ...actions... msf undefinedinetconnect set ACTION msf undefinedinetconnect show...

Firebird Relational Database isc_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/windows/misc/fb/isccreatedatabase msf undefinedisccreatedatabase show actions ...actions... msf undefinedisccreatedatabase set ACTION msf...

Borland InterBase jrd8_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. Module Options msf use exploit/linux/misc/ib/jrd8createdatabase msf undefinedjrd8createdatabase show actions ...actions... msf undefinedjrd8createdatabase set ACTION msf...

Borland InterBase open_marker_file() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. Module Options msf use exploit/linux/misc/ib/openmarkerfile msf undefinedopenmarkerfile show actions ...actions... msf undefinedopenmarkerfile set ACTION msf undefinedopenmarkerfile sh...

CA BrightStor HSM Buffer Overflow

This module exploits one of the multiple stack buffer overflows in Computer Associates BrightStor HSM. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/hsmserver msf undefinedhsmserver show...

Apple iOS iPhone Vibrate

Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded. Based on work by Charlie Miller . This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 16 include...

Apple iOS Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 200 include Msf::Payload::Single include Msf::Payload::Osx include...

Apple iOS Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Payload::Osx include...

Simple

Simple NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements simple NOP generator for ARM little endian class MetasploitModule 'Simple', 'Alias' = 'armlesimple',...

Xitami 2.5c2 Web Server If-Modified-Since Overflow

This module exploits a stack buffer overflow in the iMatix Corporation Xitami Web Server. If a malicious user sends an If-Modified-Since header containing an overly long string, it may be possible to execute a payload remotely. Due to size constraints, this module uses the Egghunter technique...

Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53. An attacker may be able to execute arbitrary code by sending an overly long string to the "ShortFormat" method in askbar.dll. Module Options msf use exploit/windows/browser/ask/shortformat msf undefinedshortformat show...

IBM Tivoli Storage Manager Express CAD Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service 5.3.3. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. Module Options msf use exploit/windows/http/ibm/tsmcadheader msf undefinedtsmcadheader sho...

Intersil (Boa) HTTPd Basic Authentication Password Reset

The Intersil extension in the Boa HTTP Server 0.93.x - 0.94.11 allows basic authentication bypass when the user string is greater than 127 bytes long. The long string causes the password to be overwritten in memory, which enables the attacker to reset the password. In addition, the malicious...

Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

This module abuses a metacharacter injection vulnerability in the HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 and earlier. The Unified Maintenance Tool contains a 'masterCGI' binary which allows an unauthenticated attacker to execute arbitrary...

Microsoft Visual Basic VBP Stack Buffer Overflow

This module exploits a stack buffer overflow in Microsoft Visual Basic 6.0. A specially crafted Visual Basic Project VBP file containing a long reference line can be used to execute arbitrary code. Module Options msf use exploit/windows/fileformat/ms/visualbasicvbp msf undefinedvisualbasicvbp sho...

Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX Control YVerInfo.dll use exploit/windows/browser/yahoomessenger/fvcom msf undefinedfvcom show actions ...actions... msf undefinedfvcom set ACTION msf undefinedfvcom show options ...show and set options... msf...

ClamAV Milter Blackhole-Mode Remote Code Execution

This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter' Sendmail mail filter. Versions prior to v0.92.2 are vulnerable. When implemented with black hole mode enabled, it is possible to execute commands remotely due to an insecure popen call. Module Options msf use...

Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow

This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51. By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/smtp/mercury/crammd5 msf undefinedcrammd5 show action...

2Wire Cross-Site Request Forgery Password Reset Vulnerability

This module will reset the admin password on a 2Wire wireless router. This is done by using the /xslt page where authentication is not required, thus allowing configuration changes such as resetting the password as administrators. Module Options msf use auxiliary/admin/2wire/xslt/passwordreset ms...

EFS Easy Chat Server Authentication Request Handling Buffer Overflow

This module exploits a stack buffer overflow in EFS Software Easy Chat Server versions 2.0 to 3.1. By sending an overly long authentication request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/efs/easychatserverusername msf...

HP OpenView Operations OVTrace Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Operations version A.07.50. By sending a specially crafted packet, a remote attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/hp/ovtrace msf undefinedovtrace show actions ...actions... msf...

SOCKS Proxy UNC Path Redirection

This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SOCKS Proxy UNC Path Redirection...

Borland Interbase Create-Request Buffer Overflow

This module exploits a stack buffer overflow in Borland Interbase 2007. By sending a specially crafted create-request packet, a remote attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/borland/interbase msf undefinedinterbase show actions ...actions... ms...

Windows RSH Daemon Buffer Overflow

This module exploits a vulnerability in Windows RSH daemon 1.8. The vulnerability is due to a failure to check for the length of input sent to the RSH server. A CPORT of 512 - 1023 must be configured for the exploit to be successful. Module Options msf use exploit/windows/misc/windows/rsh msf...

Ipswitch IMail IMAP SEARCH Buffer Overflow

This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. In order for this module to be successful, the IMAP user must have at least one message. Module...

SquirrelMail PGP Plugin Command Execution (SMTP)

This module exploits a command execution vulnerability in the PGP plugin of SquirrelMail. This flaw was found while quickly grepping the code after release of some information at http://www.wslabi.com/. Later, iDefense published an advisory .... Reading an email in SquirrelMail with the PGP plugi...