McAfee Visual Trace ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX Control NeoTraceExplorer.dll 1.0.0.1. By sending an overly long string to the "TraceTarget" method, an attacker may be able to execute arbitrary code. Module Options msf use...

EnjoySAP SAP GUI ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SAP KWEdit ActiveX Control kwedit.dll 6400.1.1.41 provided by EnjoySAP GUI. By sending an overly long string to the "PrepareToPostHTML" method, an attacker may be able to execute arbitrary code. Module Options msf use...

SAP DB 7.4 WebTools Buffer Overflow

This module exploits a stack buffer overflow in SAP DB 7.4 WebTools. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. Module Options msf use exploit/windows/http/sapdb/webtools msf undefinedwebtools show actions ...actions... msf undefinedwebtoo...

Apple iOS Default SSH Password Vulnerability

This module exploits the default credentials of Apple iOS when it has been jailbroken and the passwords for the 'root' and 'mobile' users have not been changed. Module Options msf use exploit/apple/ios/ssh/cydiadefaultssh msf undefinedcydiadefaultssh show actions ...actions... msf...

Trend Micro OfficeScan Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in Trend Micro OfficeScan cgiChkMasterPwd.exe running with SYSTEM privileges. Module Options msf use exploit/windows/http/trendmicro/officescan msf undefinedofficescan show actions ...actions... msf undefinedofficescan set ACTION msf undefinedofficesca...

Mozilla Firefox Bootstrapped Addon Social Engineering Code Execution

Mozilla Firefox before version 41 allowed users to install unsigned browser extensions from arbitrary web servers. This module dynamically creates an unsigned .xpi addon file. The resulting bootstrapped Firefox addon is presented to the victim via a web page. The victim's Firefox browser will pop...

RKD Software BarCodeAx.dll v4.9 ActiveX Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in RKD Software Barcode Application ActiveX Control 'BarCodeAx.dll'. By sending an overly long string to the BeginPrint method of BarCodeAx.dll v4.9, an attacker may be able to execute arbitrary code. Module Options msf use...

Altap Salamander 2.5 PE Viewer Buffer Overflow

This module exploits a buffer overflow in Altap Salamander use exploit/windows/fileformat/altap/salamanderpdb msf undefinedsalamanderpdb show actions ...actions... msf undefinedsalamanderpdb set ACTION msf undefinedsalamanderpdb show options ...show and set options... msf undefinedsalamanderpdb r...

CA BrightStor ARCserve for Laptops and Desktops LGServer Multiple Commands Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request to multiple commands, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use...

FlipViewer FViewerLoading ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in E-BOOK Systems FlipViewer 4.0. The vulnerability is caused due to a boundary error in the FViewerLoading FlipViewerX.dll ActiveX control when handling the "LoadOpf" method. Module Options msf use exploit/windows/browser/ebook/flipviewerfviewerloadin...

CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request rxsUseLicenseIni, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use...

CA BrightStor ARCserve for Laptops and Desktops LGServer rxsSetDataGrowthScheduleAndFilter Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request rxsSetDataGrowthScheduleAndFilter, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use...

CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/lgserver/rxrlogin...

CA Antivirus Engine CAB Buffer Overflow

This module exploits a stack buffer overflow in CA eTrust Antivirus 8.1.637. By creating a specially crafted CAB file, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/fileformat/ca/cab msf undefinedcab show actions ...actions... msf undefinedcab set ACTIO...

PostgreSQL for Linux Payload Execution

On some default Linux installations of PostgreSQL, the postgres service account may write to the /tmp directory, and may source UDF Shared Libraries from there as well, allowing execution of arbitrary code. This module compiles a Linux shared object file, uploads it to the target host via the...

Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Yahoo! Webcam Upload ActiveX Control ywcupl.dll provided by Yahoo! Messenger version 8.1.0.249. By sending an overly long string to the "Server" method, and then calling the "Send" method, an attacker may be able to execute arbitrary code. Using...

DVD X Player 5.5 .plf PlayList Buffer Overflow

This module exploits a stack-based buffer overflow on DVD X Player 5.5 Pro and Standard. By supplying a long string of data in a plf file playlist, the MediaPlayerCtrl.dll component will attempt to extract a filename out of the string, and then copy it on the stack without any proper bounds...

Logitech VideoCall ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Logitech VideoCall ActiveX Control wcamxmp.dll 2.0.3470.448. By sending an overly long string to the "Start" method, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/logitechvideocall/start msf...

Zenturi ProgramChecker ActiveX Control Arbitrary File Download

This module allows remote attackers to place arbitrary files on a users file system via the Zenturi ProgramChecker sasatl.dll 1.5.0.531 ActiveX Control. Module Options msf use exploit/windows/browser/zenturiprogramchecker/unsafe msf undefinedunsafe show actions ...actions... msf undefinedunsafe s...

Mac OS X mDNSResponder UPnP Location Overflow

This module exploits a buffer overflow that occurs when processing specially crafted requests set to mDNSResponder. All Mac OS X systems between version 10.4 and 10.4.9 without the 2007-005 patch are affected. Module Options msf use exploit/osx/mdns/upnp/location msf undefinedlocation show action...

UltraISO CUE File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in EZB Systems, Inc's UltraISO. When processing .CUE files, data is read from file into a fixed-size stack buffer. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by convincing their victim to...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaiotransnames Heap Overflow', 'Description' = %q This...

Samba lsa_io_privilege_set Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaioprivilegeset Heap Overflow', 'Description' = %q This...

Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the ISAlertDataCOM ActiveX Control ISLAert.dll provided by Symantec Norton Internet Security 2004. By sending an overly long string to the "Get" method, an attacker may be able to execute arbitrary code. Module Options msf use...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method credit Ramon and Adriano, which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba "log level" parameter is higher...

Samba "username map script" Command Execution

This module exploits a command execution vulnerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute arbitrary commands. No authentication is needed...

TinyIdentD 2.2 Stack Buffer Overflow

This module exploits a stack based buffer overflow in TinyIdentD version 2.2. If we send a long string to the ident service we can overwrite the return address and execute arbitrary code. Credit to Maarten Boone. Module Options msf use exploit/windows/misc/tiny/identdoverflow msf...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method credit Ramon and Adriano, which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba "log level" parameter is higher...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the szonefree to overwrite the size or free pointer in initialmalloczones structure. Module Options msf use exploit/osx/samba/lsa/transnamesheap msf undefinedtransnamesheap show actions ...actions...

Solaris srsexec Arbitrary File Reader

This module exploits a vulnerability in NetCommander 3.2.3 and 3.2.5. When srsexec is executed in debug -d verbose -v mode, the first line of an arbitrary file can be read due to the suid bit set. The most widely accepted exploitation vector is reading /etc/shadow, which will reveal root's hash f...

Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060 EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/antivirus/trendmicro/serverprotectearthagent msf...

Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/antivirus/trendmicro/serverprotectcreatebinding msf...

IBM TPM for OS Deployment 5.1.0.x rembo.exe Buffer Overflow

This is a stack buffer overflow exploit for IBM Tivoli Provisioning Manager for OS Deployment version 5.1.0.X. Module Options msf use exploit/windows/http/ibm/tpmfosdoverflow msf undefinedtpmfosdoverflow show actions ...actions... msf undefinedtpmfosdoverflow set ACTION msf undefinedtpmfosdoverfl...

OS X Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 61 include Msf::Payload::Single include Msf::Payload::Osx include...

OS X Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 65 include Msf::Payload::Single include Msf::Payload::Osx include...

CA BrightStor ArcServe Media Service Stack Buffer Overflow

This exploit targets a stack buffer overflow in the MediaSrv RPC service of CA BrightStor ARCserve. By sending a specially crafted SUNRPC request, an attacker can overflow a stack buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/mediasrv/sunrpc msf...

Apple QTJava toQTPointer() Arbitrary Memory Access

This module exploits an arbitrary memory access vulnerability in the Quicktime for Java API provided with Quicktime 7. Module Options msf use exploit/multi/browser/qtjava/pointer msf undefinedpointer show actions ...actions... msf undefinedpointer set ACTION msf undefinedpointer show options...

Hidden DCERPC Service Discovery

This module will query the endpoint mapper and make a list of all ncacntcp RPC services. It will then connect to each of these services and use the management API to list all other RPC services accessible on this port. Any RPC service found attached to a TCP port, but not listed in the endpoint...

Remote Management Interface Discovery

This module can be used to obtain information from the Remote Management Interface DCERPC service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Remote Management Interface Discovery',...

Endpoint Mapper Service Discovery

This module can be used to obtain information from the Endpoint Mapper service. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Endpoint Mapper Service Discovery', 'Description' = %q This modul...

LANDesk Management Suite 8.7 Alert Service Buffer Overflow

This module exploits a stack buffer overflow in LANDesk Management Suite 8.7. By sending an overly long string to the Alert Service, a buffer is overwritten and arbitrary code can be executed. Module Options msf use exploit/windows/misc/landesk/aolnsrvr msf undefinedaolnsrvr show actions...

MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)

This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. Module...

MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)

This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. This modul...

Roxio CinePlayer ActiveX Control Buffer Overflow

This module exploits a stack-based buffer overflow in SonicPlayer ActiveX control SonicMediaPlayer.dll 3.0.0.1 installed by Roxio CinePlayer 3.2. By setting an overly long value to 'DiskType', an attacker can overrun a buffer and execute arbitrary code. Module Options msf use...

Init OpenRC Persistence

This module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write service files and potentially restart services. Verified against alpine 3.21.2 Module Options msf use exploit/linux/persistence/init/openrc msf undefinedopenrc show actions...

HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow

This module exploits a stack-based buffer overflow in SPIDERLib.Loader ActiveX control Spider90.ocx 9.1.0.4353 installed by TestDirector TD for Hewlett-Packard Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32. By setting an overly long value to 'ProgColor', an attacker ca...

Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)

This module exploits a buffer overflow vulnerability in the LoadAniIcon function of USER32.dll. The flaw is triggered through Outlook Express by using the CURSOR style sheet directive to load a malicious .ANI file. This vulnerability was discovered by Alexander Sotirov of Determina and was...

Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)

This module exploits a buffer overflow vulnerability in the LoadAniIcon function in USER32.dll. The flaw can be triggered through Internet Explorer 6 and 7 by using the CURSOR style sheet directive to load a malicious .ANI file. The module can also exploit Mozilla Firefox by using a UNC path in a...

WinDVD7 IASystemInfo.DLL ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in IASystemInfo.dll ActiveX control in InterVideo WinDVD 7. By sending an overly long string to the "ApplicationType" property, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/browser/windvd7/applicationtype ms...

D-Link TFTP 1.0 Long Filename Buffer Overflow

This module exploits a stack buffer overflow in D-Link TFTP 1.0. By sending a request for an overly long file name, an attacker could overflow a buffer and execute arbitrary code. For best results, use bind payloads with nonx No NX. Module Options msf use exploit/windows/tftp/dlink/longfilename m...