Borland InterBase open_marker_file() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Borland InterBase openmarkerfile...

Borland InterBase jrd8_create_database() Buffer Overflow

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Borland InterBase...

Kazaa Altnet Download Manager ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Altnet Download Manager ActiveX Control amd4.dll bundled with Kazaa Media Desktop 3.2.7. By sending an overly long string to the "Install" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

TFTPDWIN v0.4.2 Long Filename Buffer Overflow

This module exploits the ProSysInfo TFTPDWIN threaded TFTP Server. By sending an overly long file name to the tftpd.exe server, the stack can be overwritten. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Savant 3.1 Web Server Overflow

This module exploits a stack buffer overflow in Savant 3.1 Web Server. The service supports a maximum of 10 threads for a default install. Each exploit attempt generally causes a thread to die whether successful or not. Therefore, in a default configuration, you only have 10 chances. Due to the...

Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX Control YVerInfo.dll 'Yahoo! Messenger YVerInfo.dll ActiveX Control Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in the Yahoo! Messenger ActiveX Control YVerInfo.dll MSFLICENSE,...

Xitami 2.5c2 Web Server If-Modified-Since Overflow

This module exploits a stack buffer overflow in the iMatix Corporation Xitami Web Server. If a malicious user sends an If-Modified-Since header containing an overly long string, it may be possible to execute a payload remotely. Due to size constraints, this module uses the Egghunter technique. Th...

Netcat v1.10 NT Stack Buffer Overflow

This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending an overly long string we are able to overwrite SEH. The vulnerability exists when netcat is used to bind -e an executable to a port in doexec.c. This module tested successfully using "c:\nc -L -p 31337 -e ftp". This modul...

Apple iOS iPhone Vibrate

Causes the iPhone to vibrate, only works when the AudioToolkit library has been loaded. Based on work by Charlie Miller . This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 16 include...

Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53. An attacker may be able to execute arbitrary code by sending an overly long string to the "ShortFormat" method in askbar.dll. This module requires Metasploit: https://metasploit.com/download Current source:...

Cisco IOS HTTP GET /%% Request Denial of Service

This module triggers a Denial of Service condition in the Cisco IOS HTTP server. By sending a GET request for "/%%", the device becomes unresponsive. IOS 11.1 - 12.1 are reportedly vulnerable. This module tested successfully against a Cisco 1600 Router IOS v11.218P. This module requires Metasploi...

Apple iOS Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 200 include Msf::Payload::Single include Msf::Payload::Osx include...

Apple iOS Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 152 include Msf::Payload::Single include Msf::Payload::Osx include...

Simple

Simple NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements simple NOP generator for ARM little endian class MetasploitModule 'Simple', 'Alias' = 'armlesimple',...

Trend Micro OfficeScan Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in Trend Micro OfficeScan cgiChkMasterPwd.exe running with SYSTEM privileges. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Trend...

FileCopa FTP Server Pre 18 Jul Version

This module exploits the buffer overflow found in the LIST command in fileCOPA FTP server pre 18 Jul 2006 version discovered by www.appsec.ch This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

BolinTech Dream FTP Server 1.02 Format String

This module exploits a format string overflow in the BolinTech Dream FTP Server version 1.02. Based on the exploit by SkyLined. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BolinTech Dream F...

LeapWare LeapFTP v2.7.3.600 PASV Reply Client Overflow

This module exploits a buffer overflow in the LeapWare LeapFTP v2.7.3.600 client that is triggered through an excessively long PASV reply command. This module was ported from the original exploit by drG4njubas with minor improvements. This module requires Metasploit: https://metasploit.com/downlo...

TABS MailCarrier v2.51 SMTP EHLO Overflow

This module exploits the MailCarrier v2.51 suite SMTP service. The stack is overwritten when sending an overly long EHLO command. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TABS MailCarrie...

Allied Telesyn TFTP Server 1.9 Long Filename Overflow

This module exploits a stack buffer overflow in AT-TFTP v1.9, by sending a request get/write for an overly long file name. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Allied Telesyn TFTP...

CCProxy Telnet Proxy Ping Overflow

This module exploits the YoungZSoft CCProxy 'CCProxy Telnet Proxy Ping Overflow', 'Description' = %q This module exploits the YoungZSoft CCProxy 'aushack' , 'Arch' = ARCHX86 , 'License' = MSFLICENSE, 'References' = 'CVE', '2004-2416' , 'OSVDB', '11593' , 'BID', '11666' , 'EDB', '621' , ,...

PSO Proxy v0.91 Stack Buffer Overflow

This module exploits a buffer overflow in the PSO Proxy v0.91 web server. If a client sends an excessively long string the stack is overwritten. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Trend Micro OfficeScan Client ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in Trend Micro OfficeScan Corporate Edition 7.3. By sending an overly long string to the "CgiOnUpdate" method located in the OfficeScanSetupINI.dll Control, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

HP OpenView Operations OVTrace Buffer Overflow

This module exploits a stack buffer overflow in HP OpenView Operations version A.07.50. By sending a specially crafted packet, a remote attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows RSH Daemon Buffer Overflow

This module exploits a vulnerability in Windows RSH daemon 1.8. The vulnerability is due to a failure to check for the length of input sent to the RSH server. A CPORT of 512 - 1023 must be configured for the exploit to be successful. This module requires Metasploit: https://metasploit.com/downloa...

SOCKS Proxy UNC Path Redirection

This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SOCKS Proxy UNC Path Redirection...

Ipswitch IMail IMAP SEARCH Buffer Overflow

This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. In order for this module to be successful, the IMAP user must have at least one message. This module...

Borland Interbase Create-Request Buffer Overflow

This module exploits a stack buffer overflow in Borland Interbase 2007. By sending a specially crafted create-request packet, a remote attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

EnjoySAP SAP GUI ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in SAP KWEdit ActiveX Control kwedit.dll 6400.1.1.41 provided by EnjoySAP GUI. By sending an overly long string to the "PrepareToPostHTML" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

SquirrelMail PGP Plugin Command Execution (SMTP)

This module exploits a command execution vulnerability in the PGP plugin of SquirrelMail. This flaw was found while quickly grepping the code after release of some information at http://www.wslabi.com/. Later, iDefense published an advisory .... Reading an email in SquirrelMail with the PGP plugi...

SAP DB 7.4 WebTools Buffer Overflow

This module exploits a stack buffer overflow in SAP DB 7.4 WebTools. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method credit Ramon and Adriano, which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba "log level" parameter is higher...

McAfee Visual Trace ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the McAfee Visual Trace 3.25 ActiveX Control NeoTraceExplorer.dll 1.0.0.1. By sending an overly long string to the "TraceTarget" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the szonefree to overwrite the size or free pointer in initialmalloczones structure. This module requires Metasploit: https://metasploit.com/download Current source:...

Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060 EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Logitech VideoCall ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Logitech VideoCall ActiveX Control wcamxmp.dll 2.0.3470.448. By sending an overly long string to the "Start" method, an attacker may be able to execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current...

Yahoo! Messenger 8.1.0.249 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the Yahoo! Webcam Upload ActiveX Control ywcupl.dll provided by Yahoo! Messenger version 8.1.0.249. By sending an overly long string to the "Server" method, and then calling the "Send" method, an attacker may be able to execute arbitrary code. Using...

Apple QTJava toQTPointer() Arbitrary Memory Access

This module exploits an arbitrary memory access vulnerability in the Quicktime for Java API provided with Quicktime 7. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apple QTJava toQTPointer...

TinyIdentD 2.2 Stack Buffer Overflow

This module exploits a stack based buffer overflow in TinyIdentD version 2.2. If we send a long string to the ident service we can overwrite the return address and execute arbitrary code. Credit to Maarten Boone. This module requires Metasploit: https://metasploit.com/download Current source:...

GAMSoft TelSrv 1.5 Username Buffer Overflow

This module exploits a username sprintf stack buffer overflow in GAMSoft TelSrv 1.5. Other versions may also be affected. The service terminates after exploitation, so you only get one chance! This module requires Metasploit: https://metasploit.com/download Current source:...

Apache mod_jk 1.2.20 Buffer Overflow

This is a stack buffer overflow exploit for modjk 1.2.20. Should work on any Win32 OS. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache modjk 1.2.20 Buffer Overflow', 'Description' = %q...

Samba lsa_io_privilege_set Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaioprivilegeset Heap Overflow', 'Description' = %q This...

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaiotransnames Heap Overflow', 'Description' = %q This...

Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the ISAlertDataCOM ActiveX Control ISLAert.dll provided by Symantec Norton Internet Security 2004. By sending an overly long string to the "Get" method, an attacker may be able to execute arbitrary code. This module requires Metasploit:...

IBM TPM for OS Deployment 5.1.0.x rembo.exe Buffer Overflow

This is a stack buffer overflow exploit for IBM Tivoli Provisioning Manager for OS Deployment version 5.1.0.X. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM TPM for OS Deployment 5.1.0.x...

CA BrightStor ArcServe Media Service Stack Buffer Overflow

This exploit targets a stack buffer overflow in the MediaSrv RPC service of CA BrightStor ARCserve. By sending a specially crafted SUNRPC request, an attacker can overflow a stack buffer and execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

Trend Micro ServerProtect 5.58 Buffer Overflow

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. This module requires Metasploit: https://metasploit.com/download Current source:...

MS06-019 Exchange MODPROP Heap Overflow

This module triggers a heap overflow vulnerability in MS Exchange that occurs when multiple malformed MODPROP values occur in a VCAL request. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

OS X Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 61 include Msf::Payload::Single include Msf::Payload::Osx include...