Qbik WinGate WWW Proxy Server URL Processing Overflow

This module exploits a stack buffer overflow in Qbik WinGate version 6.1.1.1077 and earlier. By sending malformed HTTP POST URL to the HTTP proxy service on port 80, a remote attacker could overflow a buffer and execute arbitrary code. Module Options msf use...

SpamAssassin spamd Remote Command Execution

This module exploits a flaw in the SpamAssassin spamd service by specifying a malicious vpopmail User header, when running with vpopmail and paranoid modes enabled non-default. Versions prior to v3.1.3 are vulnerable Module Options msf use exploit/unix/misc/spamassassin/exec msf undefinedexec sho...

Symantec Remote Management Buffer Overflow

This module exploits a stack buffer overflow in Symantec Client Security 3.0.x. This module has only been tested against Symantec Client Security 3.0.2 build 10.0.2.2000. Module Options msf use exploit/windows/antivirus/symantec/rtvscan msf undefinedrtvscan show actions ...actions... msf...

Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow

This exploit takes advantage of a stack based overflow. Once the stack corruption has occurred it is possible to overwrite a pointer which is later used for a memcpy. This gives us a write anything anywhere condition similar to a format string vulnerability. NOTE: The popsubfolders option is a...

RealVNC NULL Authentication Mode Bypass

This module exploits an Authentication bypass vulnerability in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy listener on LPORT and proxies to the target server. The AUTOVNC option requires that vncviewer be installed on the attacking machine. Module Options msf use...

FreeFTPd 1.0.10 Key Exchange Algorithm String Buffer Overflow

This module exploits a simple stack buffer overflow in FreeFTPd 1.0.10 This flaw is due to a buffer overflow error when handling a specially crafted key exchange algorithm string received from an SSH client. This module is based on MC's freesshdkeyexchange exploit. Module Options msf use...

FreeSSHd 1.0.9 Key Exchange Algorithm String Buffer Overflow

This module exploits a simple stack buffer overflow in FreeSSHd 1.0.9. This flaw is due to a buffer overflow error when handling a specially crafted key exchange algorithm string received from an SSH client. Module Options msf use exploit/windows/ssh/freesshd/keyexchange msf undefinedkeyexchange...

Non-Upper Encoder

Encodes payloads as non-alpha based bytes. This allows payloads to bypass tolower calls, but will fail isalpha. Table based design from Russel Sanford. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

AWStats migrate Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the AWStats CGI script. AWStats v6.4 and v6.5 are vulnerable. Perl based payloads are recommended with this module. The vulnerability is only present when AllowToUpdateStatsFromBrowser is enabled in the AWStats configuration fil...

Juniper SSL-VPN IVE JuniperSetupDLL.dll ActiveX Control Buffer Overflow

This module exploits a stack buffer overflow in the JuniperSetupDLL.dll library which is called by the JuniperSetup.ocx ActiveX control, as part of the Juniper SSL-VPN IVE appliance. By specifying an overly long string to the ProductName object parameter, the stack is overwritten. Module Options...

Oracle DB SQL Injection via DBMS_EXPORT_EXTENSION

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the DBMSEXPORTEXTENSION.GETDOMAININDEXMETADATA package. Note: This module has been tested against 9i, 10gR1 and 10gR2. Module Options msf use auxiliary/sqli/oracle/dbms/exportextension msf...

Non-Alpha Encoder

Encodes payloads as non-alpha based bytes. This allows payloads to bypass both toupper and tolower calls, but will fail isalpha. Table based design from Russel Sanford. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Novell Messenger Server 2.0 Accept-Language Overflow

This module exploits a stack buffer overflow in Novell GroupWise Messenger Server v2.0. This flaw is triggered by any HTTP request with an Accept-Language header greater than 16 bytes. To overwrite the return address on the stack, we must first pass a memcpy operation that uses pointers we supply...

MS06-014 Microsoft Internet Explorer COM CreateObject Code Execution

This module exploits a generic code execution vulnerability in Internet Explorer by abusing vulnerable ActiveX objects. Module Options msf use exploit/windows/browser/ie/createobject msf undefinedcreateobject show actions ...actions... msf undefinedcreateobject set ACTION msf undefinedcreateobjec...

UltraVNC 1.0.1 Client Buffer Overflow

This module exploits a buffer overflow in UltraVNC Win32 Viewer 1.0.1 Release. Module Options msf use exploit/windows/vnc/ultravnc/client msf undefinedclient show actions ...actions... msf undefinedclient set ACTION msf undefinedclient show options ...show and set options... msf undefinedclient r...

PAJAX Remote Command Execution

RedTeam has identified two security flaws in PAJAX use exploit/unix/webapp/pajax/remoteexec msf undefinedremoteexec show actions ...actions... msf undefinedremoteexec set ACTION msf undefinedremoteexec show options ...show and set options... msf undefinedremoteexec run This module requires...

MS06-013 Microsoft Internet Explorer createTextRange() Code Execution

This module exploits a code execution vulnerability in Microsoft Internet Explorer. Both IE6 and IE7 Beta 2 are vulnerable. It will corrupt memory in a way, which, under certain circumstances, can lead to an invalid/corrupt table pointer dereference. EIP will point to a very remote, non-existent...

Mercur v5.0 IMAP SP3 SELECT Buffer Overflow

Mercur v5.0 IMAP server is prone to a remotely exploitable stack-based buffer overflow vulnerability. This issue is due to a failure of the application to properly bounds check user-supplied data prior to copying it to a fixed size memory buffer. Credit to Tim Taylor for discover the vulnerabilit...

Mercur Messaging 2005 IMAP Login Buffer Overflow

This module exploits a stack buffer overflow in Atrium Mercur IMAP 5.0 SP3. Since the room for shellcode is small, using the reverse ordinal payloads yields the best results. Module Options msf use exploit/windows/imap/mercur/login msf undefinedlogin show actions ...actions... msf undefinedlogin...

PeerCast URL Handling Buffer Overflow

This module exploits a stack buffer overflow in PeerCast use exploit/windows/http/peercast/url msf undefinedurl show actions ...actions... msf undefinedurl set ACTION msf undefinedurl show options ...show and set options... msf undefinedurl run This module requires Metasploit:...

PeerCast URL Handling Buffer Overflow

This module exploits a stack buffer overflow in PeerCast use exploit/linux/http/peercast/url msf undefinedurl show actions ...actions... msf undefinedurl set ACTION msf undefinedurl show options ...show and set options... msf undefinedurl run This module requires Metasploit:...

Mail.app Image Attachment Command Execution

This module exploits a command execution vulnerability in the Mail.app application shipped with Mac OS X 10.5.0. This flaw was patched in 10.4 in March of 2007, but reintroduced into the final release of 10.5. Module Options msf use exploit/osx/email/mailapp/imageexec msf undefinedimageexec show...

Microsoft Internet Explorer isComponentInstalled Overflow

This module exploits a stack buffer overflow in Internet Explorer. This bug was patched in Windows 2000 SP4 and Windows XP SP1 according to MSRC. Module Options msf use exploit/windows/browser/ie/iscomponentinstalled msf undefinediscomponentinstalled show actions ...actions... msf...

Safari Archive Metadata Command Execution

This module exploits a vulnerability in Safari's "Safe file" feature, which will automatically open any file with one of the allowed extensions. This can be abused by supplying a zip file, containing a shell script, with a metafile indicating that the file should be opened by Terminal.app. This...

Bomberclone 0.11.6 Buffer Overflow

This module exploits a stack buffer overflow in Bomberclone 0.11.6 for Windows. The return address is overwritten with lstrcpyA memory address, the second and third value are the destination buffer, the fourth value is the source address of our buffer in the stack. This exploit is like a return i...

Autostart Desktop Item Persistence

This module will create an autostart .desktop entry to execute a payload. The payload will be executed when the users logs in. Verified on Ubuntu 22.04 desktop with Gnome, and 18.04.3. The following payloads were used in testing: - cmd/unix/reversenetcat - linux/x64/meterpreter/reversetcp -...

HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow

This module exploits a stack buffer overflow in HTML Help Workshop 4.74 By creating a specially crafted hhp file, an attacker may be able to execute arbitrary code. Module Options msf use exploit/windows/fileformat/hhw/hhpcompiledfilebof msf undefinedhhpcompiledfilebof show actions ...actions...

HTML Help Workshop 4.74 (hhp Project File) Buffer Overflow

This module exploits a stack buffer overflow in HTML Help Workshop 4.74 by creating a specially crafted hhp file. Module Options msf use exploit/windows/fileformat/hhw/hhpcontentfilebof msf undefinedhhpcontentfilebof show actions ...actions... msf undefinedhhpcontentfilebof set ACTION msf...

Firefox location.QueryInterface() Code Execution

This module exploits a code execution vulnerability in the Mozilla Firefox browser. To reliably exploit this vulnerability, we need to fill almost a gigabyte of memory with our nop sled and payload. This module has been tested on OS X 10.3 with the stock Firefox 1.5.0 package. Module Options msf...

Winamp Playlist UNC Path Computer Name Overflow

This module exploits a vulnerability in the Winamp media player. This flaw is triggered when an audio file path is specified, inside a playlist, that consists of a UNC path with a long computer name. This module delivers the playlist via the browser. This module has only been successfully tested ...

KarjaSoft Sami FTP Server v2.0.2 USER Overflow

This module exploits an unauthenticated stack buffer overflow in KarjaSoft Sami FTP Server version 2.0.2 by sending an overly long USER string during login. The payload is triggered when the administrator opens the application GUI. If the GUI window is open at the time of exploitation, the payloa...

Unix Command Shell, Reverse TCP (via Perl)

Creates an interactive shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 234 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo...

Linux Mettle x86, Reverse TCP Stager

Inject the mettle server payload staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 123 include Msf::Payload::Stager include...

Linux Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 123 include Msf::Payload::Stager include Msf::Payload::Linux::ReverseTcpx...

Unix Command Shell, Bind TCP (via Perl)

Listen for a connection and spawn a command shell via perl This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 240 include Msf::Payload::Single include Msf::Sessions::CommandShellOptio...

Polymorphic XOR Additive Feedback Encoder

This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically. This module requires Metasploit: https://metasploit.com/download Current source:...

SPARC NOP Generator

SPARC NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements NOP generator for the SPARC platform class MetasploitModule Msf::Nop Nop types InsSethi = 0 InsArithmetic...

Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 68 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends includ...

Generic Shell Variable Substitution Command Encoder

This encoder uses standard Bourne shell variable substitution tricks to avoid commonly restricted characters. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Generic Shell Variable Substitution...

SPARC DWORD XOR Encoder

This encoder is optyx's 48-byte SPARC encoder with some tweaks. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SPARC DWORD XOR Encoder', 'Description' = %q This encoder is optyx's 48-byte SPAR...

Unix Command Shell, Bind TCP (inetd)

Listen for a connection and spawn a command shell persistent This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 487 include Msf::Payload::Single include...

Unix Command Shell, Double Reverse TCP (telnet)

Creates an interactive shell through two inbound connections This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 130 include Msf::Payload::Single include...

Unix Command Shell, Reverse TCP (/dev/tcp)

Creates an interactive shell via bash's builtin /dev/tcp. This will not work on circa 2009 and older Debian-based Linux distributions including Ubuntu because they compile bash without the /dev/tcp feature. This module requires Metasploit: https://metasploit.com/download Current source:...

Alpha2 Alphanumeric Unicode Uppercase Encoder

Encodes payload as unicode-safe uppercase text. This encoder uses SkyLined's Alpha2 encoding suite. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/encoder/alpha2/unicodeupper' class MetasploitModule...

Alpha2 Alphanumeric Unicode Mixedcase Encoder

Encodes payload as unicode-safe mixedcase text. This encoder uses SkyLined's Alpha2 encoding suite. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/encoder/alpha2/unicodemixed' class MetasploitModule...

Alpha2 Alphanumeric Uppercase Encoder

Encodes payloads as alphanumeric uppercase text. This encoder uses SkyLined's Alpha2 encoding suite. A pure alpha encoder is impossible without having a register that points at or near the shellcode. In a default configuration the first few bytes at the beginning are an fnstenv getpc stub the sam...

Alpha2 Alphanumeric Mixedcase Encoder

Encodes payloads as alphanumeric mixedcase text. This encoder uses SkyLined's Alpha2 encoding suite. A pure alpha encoder is impossible without having a register that points at or near the shellcode. In a default configuration the first few bytes at the beginning are an fnstenv getpc stub the sam...

Simple

Simple NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements simple NOP generator for PowerPC class MetasploitModule 'Simple', 'Alias' = 'ppcsimple', 'Description' =...

Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution

This module exploits a vulnerability in the GDI library included with Windows XP and 2003. This vulnerability uses the 'Escape' metafile function to execute arbitrary code through the SetAbortProc procedure. This module generates a random WMF record stream for each request. Module Options msf use...

Unix Command, Generic Command Execution

Executes the supplied command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 8 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo =...