PHP Command, Double Reverse TCP Connection (via Perl)

Creates an interactive shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include Msf::Payload::Php include...

PHP Nop Generator

Generates harmless padding for PHP scripts This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This class implements a "nop" generator for PHP payloads class MetasploitModule 'PHP Nop Generator', 'Alias' = 'phpgeneric',...

PHP Command Shell, Bind TCP (via Perl)

Listen for a connection and spawn a command shell via perl persistent This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include...

Generic PHP Remote File Include

This module can be used to exploit any generic PHP remote file include vulnerability, where the application includes code like the following: Module Options msf use exploit/unix/webapp/php/include msf undefinedinclude show actions ...actions... msf undefinedinclude set ACTION msf undefinedinclude...

MailEnable IMAPD (2.34/2.35) Login Request Buffer Overflow

MailEnable's IMAP server contains a buffer overflow vulnerability in the Login command. Module Options msf use exploit/windows/imap/mailenable/login msf undefinedlogin show actions ...actions... msf undefinedlogin set ACTION msf undefinedlogin show options ...show and set options... msf...

FileZilla FTP Server Malformed PORT Denial of Service

This module triggers a Denial of Service condition in the FileZilla FTP Server versions 0.9.21 and earlier. By sending a malformed PORT command then LIST command, the server attempts to write to a NULL pointer. Module Options msf use auxiliary/dos/windows/ftp/filezilla/serverport msf...

Microsoft Plug and Play Service Registry Overflow

This module triggers a stack buffer overflow in the Windows Plug and Play service. This vulnerability can be exploited on Windows 2000 without a valid user account. Since the PnP service runs inside the service.exe process, this module will result in a forced reboot on Windows 2000. Obtaining cod...

Veritas Backup Exec Server Registry Access

This modules exploits a remote registry access flaw in the BackupExec Windows Server RPC service. This vulnerability was discovered by Pedram Amini and is based on the NDR stub information posted to openrce.org. Please see the action list for the different attack modes. This module requires...

Allied Telesyn TFTP Server 1.9 Long Filename Overflow

This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a request get/write for an overly long file name. Module Options msf use exploit/windows/tftp/attftp/longfilename msf undefinedlongfilename show actions ...actions... msf undefinedlongfilename set ACTION msf...

3CTftpSvc TFTP Long Mode Buffer Overflow

This module exploits a stack buffer overflow in 3CTftpSvc 2.0.1. By sending a specially crafted packet with an overly long mode field, a remote attacker could overflow a buffer and execute arbitrary code on the system. Module Options msf use exploit/windows/tftp/threectftpsvc/longmode msf...

ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)

This module exploits a stack-based buffer overflow in versions 1.2 through 1.3.0 of ProFTPD server. The vulnerability is within the "sreplace" function within the "src/support.c" file. The off-by-one heap overflow bug in the ProFTPD sreplace function has been discovered about 2 two years ago by...

CA BrightStor ARCserve Tape Engine Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup r11.1 - r11.5. By sending a specially crafted DCERPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/tape/engine msf...

XMPlay 3.3.0.4 (ASX Filename) Buffer Overflow

This module exploits a stack buffer overflow in XMPlay 3.3.0.4. The vulnerability is caused due to a boundary error within the parsing of playlists containing an overly long file name. This module uses the ASX file format. Module Options msf use exploit/windows/browser/xmplay/asx msf undefinedasx...

FreeBSD Remote NFS RPC Request Denial of Service

This module sends a specially-crafted NFS Mount request causing a kernel panic on host running FreeBSD 6.0. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FreeBSD Remote NFS RPC Request Denial...

MS06-066 Microsoft Services nwapi32.dll Module Exploit

This module exploits a stack buffer overflow in the svchost service when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. Module Options msf use exploit/windows/smb/ms06/066nwapi msf undefined066nwapi show actions ...actions... msf undefined066nwapi...

MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability

This module exploits a heap overflow vulnerability in the KeyFrame method of the direct animation ActiveX control. This is a port of the exploit implemented by Alexander Sotirov. Module Options msf use exploit/windows/browser/ms06/067keyframe msf undefined067keyframe show actions ...actions... ms...

MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow

This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect function using the Workstation service in Windows 2000 SP4 and Windows XP SP2. In order to exploit this vulnerability, you must specify the name of a valid Windows DOMAIN. It may be possible to satisfy this conditio...

MS06-066 Microsoft Services nwwks.dll Module Exploit

This module exploits a stack buffer overflow in the svchost service, when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. Module Options msf use exploit/windows/smb/ms06/066nwwks msf undefined066nwwks show actions ...actions... msf undefined066nwwk...

America Online ICQ ActiveX Control Arbitrary File Download and Execute

This module allows remote attackers to download and execute arbitrary files on a users system via the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control. Module Options msf use exploit/windows/browser/aol/icqdownloadagent msf undefinedicqdownloadagent show actions ...actions...

Omni-NFS Server Buffer Overflow

This module exploits a stack buffer overflow in Xlink Omni-NFS Server 5.2 When sending a specially crafted nfs packet, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/nfs/xlink/nfsd msf undefinednfsd show actions ...actions... msf undefinednfsd set ACTION...

TikiWiki Information Disclosure

A vulnerability has been reported in Tikiwiki, which can be exploited by an anonymous user to dump the MySQL user & passwd just by creating a mysql error with the "sortmode" var. The vulnerability was reported in Tikiwiki version 1.9.5. Module Options msf use auxiliary/admin/tikiwiki/tikidblib ms...

SIP Invite Spoof

This module will create a fake SIP invite request making the targeted device ring and display fake caller id information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Invite Spoof',...

Microsoft Windows NAT Helper Denial of Service

This module exploits a denial of service vulnerability within the Internet Connection Sharing service in Windows XP. Module Options msf use auxiliary/dos/windows/nat/nat/helper msf undefinedhelper show actions ...actions... msf undefinedhelper set ACTION msf undefinedhelper show options ...show a...

Novell eDirectory NDS Server Host Header Overflow

This module exploits a stack buffer overflow in Novell eDirectory 8.8.1. The web interface does not validate the length of the HTTP Host header prior to using the value of that header in an HTTP redirect. Module Options msf use exploit/windows/http/edirectory/host msf undefinedhost show actions...

Solaris libnspr NSPR_LOG_FILE Privilege Escalation

This module exploits an arbitrary file write vulnerability in the Netscape Portable Runtime library libnspr on unpatched Solaris systems prior to Solaris 10u3 which allows users to gain root privileges. libnspr versions prior to 4.6.3 allow users to specify a log file with the NSPRLOGFILE...

Microsoft SRV.SYS Pipe Transaction No Null

This module exploits a NULL pointer dereference flaw in the SRV.SYS driver of the Windows operating system. This bug was independently discovered by CORE Security and ISS. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framewo...

MS06-071 Microsoft Internet Explorer XML Core Services HTTP Request Handling

This module exploits a code execution vulnerability in Microsoft XML Core Services which exists in the XMLHTTP ActiveX control. This module is the modified version of http://www.milw0rm.com/exploits/2743 - credit to str0ke. This module has been successfully tested on Windows 2000 SP4, Windows XP...

SHTTPD URI-Encoded POST Request Overflow

This module exploits a stack buffer overflow in SHTTPD use exploit/windows/http/shttpd/post msf undefinedpost show actions ...actions... msf undefinedpost set ACTION msf undefinedpost show options ...show and set options... msf undefinedpost run This module requires Metasploit:...

CA BrightStor ARCserve Message Engine Heap Overflow

This module exploits a heap overflow in Computer Associates BrightStor ARCserve Backup 11.5. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/message/engineheap msf undefinedengineheap...

Windows Executable Download (http,https,ftp) and Execute

Download an EXE from an HTTPS/FTP URL and execute it This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 429 include Msf::Payload::Windows include Msf::Payload::Single include...

NaviCOPA 2.0.1 URL Handling Buffer Overflow

This module exploits a stack buffer overflow in NaviCOPA 2.0.1. The vulnerability is caused due to a boundary error within the handling of URL parameters. Module Options msf use exploit/windows/http/navicopa/getoverflow msf undefinedgetoverflow show actions ...actions... msf undefinedgetoverflow...

TFTPDWIN v0.4.2 Long Filename Buffer Overflow

This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending an overly long file name to the tftpd.exe server, the stack can be overwritten. Module Options msf use exploit/windows/tftp/tftpdwin/longfilename msf undefinedlongfilename show actions ...actions... msf...

MS06-055 Microsoft Internet Explorer VML Fill Method Code Execution

This module exploits a code execution vulnerability in Microsoft Internet Explorer using a buffer overflow in the VML processing code VGX.dll. This module has been tested on Windows 2000 SP4, Windows XP SP0, and Windows XP SP2. Module Options msf use exploit/windows/browser/ms06/055vmlmethod msf...

Solaris LPD Arbitrary File Delete

This module uses a vulnerability in the Solaris line printer daemon to delete arbitrary files on an affected system. This can be used to exploit the rpc.walld format string flaw, the missing krb5.conf authentication bypass, or simply delete system files. Tested on Solaris 2.6, 7, 8, 9, and 10. Th...

Ipswitch WS_FTP Server 5.05 XMD5 Overflow

This module exploits a buffer overflow in the XMD5 verb in IPSWITCH WSFTP Server 5.05. Module Options msf use exploit/windows/ftp/wsftp/server505xmd5 msf undefinedserver505xmd5 show actions ...actions... msf undefinedserver505xmd5 set ACTION msf undefinedserver505xmd5 show options ...show and set...

TikiWiki jhot Remote Command Execution

TikiWiki contains a flaw that may allow a malicious user to execute arbitrary PHP code. The issue is triggered due to the jhot.php script not correctly verifying uploaded files. It is possible that the flaw may allow arbitrary PHP code execution by uploading a malicious PHP script resulting in a...

MaxDB WebDBM Database Parameter Overflow

This module exploits a stack buffer overflow in the MaxDB WebDBM service. By sending a specially-crafted HTTP request that contains an overly long database name. A remote attacker could overflow a buffer and execute arbitrary code on the system with privileges of the wahttp process. This module h...

Generic Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Single include Msf::Payload::Generic def initializeinfo =...

Generic Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Single include Msf::Payload::Generic def initializeinfo =...

Service Upstart Persistence

This module will create a service on the box, and mark it for auto-restart. We need enough access to write service files and potentially restart services Targets: CentOS 6 Fedora = 9, = 9.10, use exploit/linux/persistence/init/upstart msf undefinedupstart show actions ...actions... msf...

Texas Imperial Software WFTPD 3.23 SIZE Overflow

This module exploits a buffer overflow in the SIZE verb in Texas Imperial's Software WFTPD 3.23. Module Options msf use exploit/windows/ftp/wftpd/size msf undefinedsize show actions ...actions... msf undefinedsize set ACTION msf undefinedsize show options ...show and set options... msf...

Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access

This module tests for a logic vulnerability in the Cisco VPN Concentrator 3000 series. It is possible to execute some FTP statements without authentication CWD, RNFR, MKD, RMD, SIZE, CDUP. It also appears to have some memory leak bugs when working with CWD commands. This module simply creates an...

Avoid UTF8/tolower

UTF8 Safe, tolower Safe Encoder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework NOTE: Read this if you plan on using this encoder: This encoder has some limitations that must be considered. First, this encoder cannot ...

MSSQL Ping Utility

This module simply queries the MSSQL Browser service for server information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MSSQL Ping Utility', 'Description' = 'This module simply queries the...

MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow

This module exploits a stack buffer overflow in the NetApi32 CanonicalizePathName function using the NetpwPathCanonicalize RPC call in the Server Service. It is likely that other RPC calls could be used to exploit this service. This exploit will result in a denial of service on Windows XP SP2 or...

OS X Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 74 include Msf::Payload::Single include Msf::Payload::Osx include...

McAfee Subscription Manager Stack Buffer Overflow

This module exploits a flaw in the McAfee Subscription Manager ActiveX control. Due to an unsafe use of vsprintf, it is possible to trigger a stack buffer overflow by passing a large string to one of the COM-exposed routines, such as IsAppExpired. This vulnerability was discovered by Karl Lynn of...

Apple iOS MobileSafari LibTIFF Buffer Overflow

This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. Module Options msf use exploit/apple/ios/browser/safarilibtiff ms...

Apple iOS MobileMail LibTIFF Buffer Overflow

This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload. Module Options msf use exploit/apple/ios/email/mobilemaillibtiff...

Easy File Sharing FTP Server 2.0 PASS Overflow

This module exploits a stack buffer overflow in the Easy File Sharing 2.0 service. By sending an overly long password, an attacker can execute arbitrary code. Module Options msf use exploit/windows/ftp/easyfilesharing/pass msf undefinedpass show actions ...actions... msf undefinedpass set ACTION...