Xitami 2.5c2 Web Server If-Modified-Since Overflow

This module exploits a stack buffer overflow in the iMatix Corporation Xitami Web Server. If a malicious user sends an If-Modified-Since header containing an overly long string, it may be possible to execute a payload remotely. Due to size constraints, this module uses the Egghunter technique...

Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53. An attacker may be able to execute arbitrary code by sending an overly long string to the "ShortFormat" method in askbar.dll. Module Options msf use exploit/windows/browser/ask/shortformat msf undefinedshortformat show...

IBM Tivoli Storage Manager Express CAD Service Buffer Overflow

This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service 5.3.3. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. Module Options msf use exploit/windows/http/ibm/tsmcadheader msf undefinedtsmcadheader sho...

Intersil (Boa) HTTPd Basic Authentication Password Reset

The Intersil extension in the Boa HTTP Server 0.93.x - 0.94.11 allows basic authentication bypass when the user string is greater than 127 bytes long. The long string causes the password to be overwritten in memory, which enables the attacker to reset the password. In addition, the malicious...

Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution

This module abuses a metacharacter injection vulnerability in the HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 and earlier. The Unified Maintenance Tool contains a 'masterCGI' binary which allows an unauthenticated attacker to execute arbitrary...

Microsoft Visual Basic VBP Stack Buffer Overflow

This module exploits a stack buffer overflow in Microsoft Visual Basic 6.0. A specially crafted Visual Basic Project VBP file containing a long reference line can be used to execute arbitrary code. Module Options msf use exploit/windows/fileformat/ms/visualbasicvbp msf undefinedvisualbasicvbp sho...

Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX Control YVerInfo.dll use exploit/windows/browser/yahoomessenger/fvcom msf undefinedfvcom show actions ...actions... msf undefinedfvcom set ACTION msf undefinedfvcom show options ...show and set options... msf...

ClamAV Milter Blackhole-Mode Remote Code Execution

This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter' Sendmail mail filter. Versions prior to v0.92.2 are vulnerable. When implemented with black hole mode enabled, it is possible to execute commands remotely due to an insecure popen call. Module Options msf use...

Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow

This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51. By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/smtp/mercury/crammd5 msf undefinedcrammd5 show action...

2Wire Cross-Site Request Forgery Password Reset Vulnerability

This module will reset the admin password on a 2Wire wireless router. This is done by using the /xslt page where authentication is not required, thus allowing configuration changes such as resetting the password as administrators. Module Options msf use auxiliary/admin/2wire/xslt/passwordreset ms...

EFS Easy Chat Server Authentication Request Handling Buffer Overflow

This module exploits a stack buffer overflow in EFS Software Easy Chat Server versions 2.0 to 3.1. By sending an overly long authentication request, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/http/efs/easychatserverusername msf...

HP OpenView Operations OVTrace Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Operations version A.07.50. By sending a specially crafted packet, a remote attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/hp/ovtrace msf undefinedovtrace show actions ...actions... msf...

SOCKS Proxy UNC Path Redirection

This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SOCKS Proxy UNC Path Redirection...

Windows RSH Daemon Buffer Overflow

This module exploits a vulnerability in Windows RSH daemon 1.8. The vulnerability is due to a failure to check for the length of input sent to the RSH server. A CPORT of 512 - 1023 must be configured for the exploit to be successful. Module Options msf use exploit/windows/misc/windows/rsh msf...

Borland Interbase Create-Request Buffer Overflow

This module exploits a stack buffer overflow in Borland Interbase 2007. By sending a specially crafted create-request packet, a remote attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/misc/borland/interbase msf undefinedinterbase show actions ...actions... ms...

Ipswitch IMail IMAP SEARCH Buffer Overflow

This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. In order for this module to be successful, the IMAP user must have at least one message. Module...

SquirrelMail PGP Plugin Command Execution (SMTP)

This module exploits a command execution vulnerability in the PGP plugin of SquirrelMail. This flaw was found while quickly grepping the code after release of some information at http://www.wslabi.com/. Later, iDefense published an advisory .... Reading an email in SquirrelMail with the PGP plugi...

McAfee Visual Trace ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX Control NeoTraceExplorer.dll 1.0.0.1. By sending an overly long string to the "TraceTarget" method, an attacker may be able to execute arbitrary code. Module Options msf use...

EnjoySAP SAP GUI ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SAP KWEdit ActiveX Control kwedit.dll 6400.1.1.41 provided by EnjoySAP GUI. By sending an overly long string to the "PrepareToPostHTML" method, an attacker may be able to execute arbitrary code. Module Options msf use...

SAP DB 7.4 WebTools Buffer Overflow

This module exploits a stack buffer overflow in SAP DB 7.4 WebTools. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. Module Options msf use exploit/windows/http/sapdb/webtools msf undefinedwebtools show actions ...actions... msf undefinedwebtoo...

Apple iOS Default SSH Password Vulnerability

This module exploits the default credentials of Apple iOS when it has been jailbroken and the passwords for the 'root' and 'mobile' users have not been changed. Module Options msf use exploit/apple/ios/ssh/cydiadefaultssh msf undefinedcydiadefaultssh show actions ...actions... msf...

Trend Micro OfficeScan Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in Trend Micro OfficeScan cgiChkMasterPwd.exe running with SYSTEM privileges. Module Options msf use exploit/windows/http/trendmicro/officescan msf undefinedofficescan show actions ...actions... msf undefinedofficescan set ACTION msf undefinedofficesca...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

Mozilla Firefox before version 41 allowed users to install unsigned browser extensions from arbitrary web servers. This module dynamically creates an unsigned .xpi addon file. The resulting bootstrapped Firefox addon is presented to the victim via a web page. The victim's Firefox browser will pop...

RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in RKD Software Barcode Application ActiveX Control 'BarCodeAx.dll'. By sending an overly long string to the BeginPrint method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code. Module Options msf use...

Altap Salamander 2.5 PE Viewer Buffer Overflow

This module exploits a buffer overflow in Altap Salamander use exploit/windows/fileformat/altap/salamanderpdb msf undefinedsalamanderpdb show actions ...actions... msf undefinedsalamanderpdb set ACTION msf undefinedsalamanderpdb show options ...show and set options... msf undefinedsalamanderpdb r...

FlipViewer FViewerLoading ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in E-BOOK Systems FlipViewer 4.0. The vulnerability is caused due to a boundary error in the FViewerLoading FlipViewerX.dll ActiveX control when handling the "LoadOpf" method. Module Options msf use exploit/windows/browser/ebook/flipviewerfviewerloadin...

CA BrightStor ARCserve for Laptops and Desktops LGServer Multiple Commands Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request to multiple commands, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use...

CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/lgserver/rxrlogin...

CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request rxsUseLicenseIni, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use...

CA BrightStor ARCserve for Laptops and Desktops LGServer rxsSetDataGrowthScheduleAndFilter Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request rxsSetDataGrowthScheduleAndFilter, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use...

PostgreSQL for Linux Payload Execution

On some default Linux installations of PostgreSQL, the postgres service account may write to the /tmp directory, and may source UDF Shared Libraries from there as well, allowing execution of arbitrary code. This module compiles a Linux shared object file, uploads it to the target host via the...

Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Yahoo! Webcam Upload ActiveX Control ywcupl.dll provided by Yahoo! Messenger version 8.1.0.249. By sending an overly long string to the "Server" method, and then calling the "Send" method, an attacker may be able to execute arbitrary code. Using...

CA Antivirus Engine CAB Buffer Overflow

This module exploits a stack buffer overflow in CA eTrust Antivirus 8.1.637. By creating a specially crafted CAB file, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/fileformat/ca/cab msf undefinedcab show actions ...actions... msf undefinedcab set ACTIO...

DVD X Player 5.5 .plf PlayList Buffer Overflow

This module exploits a stack-based buffer overflow on DVD X Player 5.5 Pro and Standard. By supplying a long string of data in a plf file playlist, the MediaPlayerCtrl.dll component will attempt to extract a filename out of the string, and then copy it on the stack without any proper bounds...

Logitech VideoCall ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Logitech VideoCall ActiveX Control wcamxmp.dll 2.0.3470.448. By sending an overly long string to the "Start" method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/logitechvideocall/start msf...

Zenturi ProgramChecker ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system via the Zenturi ProgramChecker sasatl.dll 1.5.0.531 ActiveX Control. Module Options msf use exploit/windows/browser/zenturiprogramchecker/unsafe msf undefinedunsafe show actions ...actions... msf undefinedunsafe s...

Mac OS X mDNSResponder UPnP Location Overflow

This module exploits a buffer overflow that occurs when processing specially crafted requests set to mDNSResponder. All Mac OS X systems between version 10.4 and 10.4.9 without the 2007-005 patch are affected. Module Options msf use exploit/osx/mdns/upnp/location msf undefinedlocation show action...

UltraISO CUE File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in EZB Systems, Inc's UltraISO. When processing .CUE files, data is read from file into a fixed-size stack buffer. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by convincing their victim to...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaiotransnames Heap Overflow', 'Description' = %q This...

Samba lsa_io_privilege_set Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaioprivilegeset Heap Overflow', 'Description' = %q This...

Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the ISAlertDataCOM ActiveX Control ISLAert.dll provided by Symantec Norton Internet Security 2004. By sending an overly long string to the "Get" method, an attacker may be able to execute arbitrary code. Module Options msf use...

TinyIdentD 2.2 Stack Buffer Overflow

This module exploits a stack based buffer overflow in TinyIdentD version 2.2. If we send a long string to the ident service we can overwrite the return address and execute arbitrary code. Credit to Maarten Boone. Module Options msf use exploit/windows/misc/tiny/identdoverflow msf...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method credit Ramon and Adriano, which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba "log level" parameter is higher...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method credit Ramon and Adriano, which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba "log level" parameter is higher...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the szonefree to overwrite the size or free pointer in initialmalloczones structure. Module Options msf use exploit/osx/samba/lsa/transnamesheap msf undefinedtransnamesheap show actions ...actions...

Samba "username map script" Command Execution

This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute arbitrary commands. No authentication is needed...

Solaris srsexec Arbitrary File Reader

This module exploits a vulnerability in NetCommander 3.2.3 and 3.2.5. When srsexec is executed in debug -d verbose -v mode, the first line of an arbitrary file can be read due to the suid bit set. The most widely accepted exploitation vector is reading /etc/shadow, which will reveal root's hash f...

Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/antivirus/trendmicro/serverprotectcreatebinding msf...

Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060 EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/antivirus/trendmicro/serverprotectearthagent msf...

IBM TPM for OS Deployment 5.1.0.x rembo.exe Buffer Overflow

This is a stack buffer overflow exploit for IBM Tivoli Provisioning Manager for OS Deployment version 5.1.0.X. Module Options msf use exploit/windows/http/ibm/tpmfosdoverflow msf undefinedtpmfosdoverflow show actions ...actions... msf undefinedtpmfosdoverflow set ACTION msf undefinedtpmfosdoverfl...