Polymorphic XOR Additive Feedback Encoder

This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically. This module requires Metasploit: https://metasploit.com/download Current source:...

SPARC NOP Generator

SPARC NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements NOP generator for the SPARC platform class MetasploitModule Msf::Nop Nop types InsSethi = 0 InsArithmetic...

Linux Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 68 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends includ...

Generic Shell Variable Substitution Command Encoder

This encoder uses standard Bourne shell variable substitution tricks to avoid commonly restricted characters. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Generic Shell Variable Substitution...

SPARC DWORD XOR Encoder

This encoder is optyx's 48-byte SPARC encoder with some tweaks. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SPARC DWORD XOR Encoder', 'Description' = %q This encoder is optyx's 48-byte SPAR...

Unix Command Shell, Bind TCP (inetd)

Listen for a connection and spawn a command shell persistent This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 487 include Msf::Payload::Single include...

Unix Command Shell, Reverse TCP (/dev/tcp)

Creates an interactive shell via bash's builtin /dev/tcp. This will not work on circa 2009 and older Debian-based Linux distributions including Ubuntu because they compile bash without the /dev/tcp feature. This module requires Metasploit: https://metasploit.com/download Current source:...

Unix Command Shell, Double Reverse TCP (telnet)

Creates an interactive shell through two inbound connections This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 130 include Msf::Payload::Single include...

Alpha2 Alphanumeric Unicode Uppercase Encoder

Encodes payload as unicode-safe uppercase text. This encoder uses SkyLined's Alpha2 encoding suite. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/encoder/alpha2/unicodeupper' class MetasploitModule...

Alpha2 Alphanumeric Unicode Mixedcase Encoder

Encodes payload as unicode-safe mixedcase text. This encoder uses SkyLined's Alpha2 encoding suite. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/encoder/alpha2/unicodemixed' class MetasploitModule...

Alpha2 Alphanumeric Mixedcase Encoder

Encodes payloads as alphanumeric mixedcase text. This encoder uses SkyLined's Alpha2 encoding suite. A pure alpha encoder is impossible without having a register that points at or near the shellcode. In a default configuration the first few bytes at the beginning are an fnstenv getpc stub the sam...

Alpha2 Alphanumeric Uppercase Encoder

Encodes payloads as alphanumeric uppercase text. This encoder uses SkyLined's Alpha2 encoding suite. A pure alpha encoder is impossible without having a register that points at or near the shellcode. In a default configuration the first few bytes at the beginning are an fnstenv getpc stub the sam...

Simple

Simple NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework SingleByte ---------- This class implements simple NOP generator for PowerPC class MetasploitModule 'Simple', 'Alias' = 'ppcsimple', 'Description' =...

Windows XP/2003/Vista Metafile Escape() SetAbortProc Code Execution

This module exploits a vulnerability in the GDI library included with Windows XP and 2003. This vulnerability uses the 'Escape' metafile function to execute arbitrary code through the SetAbortProc procedure. This module generates a random WMF record stream for each request. Module Options msf use...

Unix Command, Generic Command Execution

Executes the supplied command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 8 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def initializeinfo =...

Unix Command, Interact with Established Connection

Interacts with a shell on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 0 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions...

Qualcomm WorldMail 3.0 IMAPD LIST Buffer Overflow

This module exploits a stack buffer overflow in the Qualcomm WorldMail IMAP Server version 3.0 builds 6.1.19.0 through 6.1.22.0. Version 6.1.22.1 fixes this particular vulnerability. NOTE: The service does NOT restart automatically by default. You may be limited to only one attempt, so choose...

Mercury/32 PH Server Module Buffer Overflow

This module exploits a stack-based buffer overflow in Mercury/32 use exploit/windows/misc/mercury/phonebook msf undefinedphonebook show actions ...actions... msf undefinedphonebook set ACTION msf undefinedphonebook show options ...show and set options... msf undefinedphonebook run This module...

Notepad++ Plugin Persistence

This module create persistence by adding a malicious plugin to Notepad++, as it blindly loads and executes DLL from its plugin directory on startup, meaning that the payload will be executed every time Notepad++ is launched. Module Options msf use exploit/windows/persistence/notepadpp/plugin msf...

Lyris ListManager MSDE Weak sa Password

This module exploits a weak password vulnerability in the Lyris ListManager MSDE install. During installation, the 'sa' account password is set to 'lminstall'. Once the install completes, it is set to 'lyris' followed by the process ID of the installer. This module brute forces all possible proce...

MS05-054 Microsoft Internet Explorer JavaScript OnLoad Handler Remote Code Execution

This bug is triggered when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window' JavaScript function. This exploit results in a call to an address lower than the heap. The javascript prompt places our shellcode near where the call operand points...

Novell NetMail IMAP STATUS Buffer Overflow

This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP STATUS verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. Module Options msf use exploit/windows/imap/novell/netmailstatus msf undefinednetmailstatus show actions...

freeFTPd 1.0 Username Overflow

This module exploits a stack buffer overflow in the freeFTPd multi-protocol file transfer service. This flaw can only be exploited when logging has been enabled non-default. Module Options msf use exploit/windows/ftp/freeftpd/user msf undefineduser show actions ...actions... msf undefineduser set...

FileZilla FTP Server Admin Interface Denial of Service

This module triggers a Denial of Service condition in the FileZilla FTP Server Administration Interface in versions 0.9.4d and earlier. By sending a procession of excessively long USER commands to the FTP Server, the Administration Interface FileZilla Server Interface.exe when running, will...

PPC LongXOR Encoder

This encoder is ghandi's PPC dword xor encoder with some size tweaks by HDM. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PPC LongXOR Encoder', 'Description' = %q This encoder is ghandi's PP...

PPC LongXOR Encoder

This encoder is ghandi's PPC dword xor encoder but uses a tag-based terminator rather than a length. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PPC LongXOR Encoder', 'Description' = %q Thi...

The "none" Encoder

This "encoder" does not transform the payload in any way. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'The "none" Encoder', 'Description' = %q This "encoder" does not transform the payload i...

Single-byte XOR Countdown Encoder

This encoder uses the length of the payload as a position-dependent encoder key to produce a small decoder stub. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Single-byte XOR Countdown...

Variable-length Fnstenv/mov Dword XOR Encoder

This encoder uses a variable-length mov equivalent instruction with fnstenv for getip. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Variable-length Fnstenv/mov Dword XOR Encoder',...

Microsoft IIS ISAPI RSA WebAgent Redirect Overflow

This module exploits a stack buffer overflow in the SecurID Web Agent for IIS. This ISAPI filter runs in-process with inetinfo.exe, any attempt to exploit this flaw will result in the termination and potential restart of the IIS service. Module Options msf use...

Snort Back Orifice Pre-Preprocessor Buffer Overflow

This module exploits a stack buffer overflow in the Back Orifice pre-processor module included with Snort versions 2.4.0, 2.4.1, 2.4.2, and 2.4.3. This vulnerability could be used to completely compromise a Snort sensor, and would typically gain an attacker full root or administrative privileges...

Solaris Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 136 include Msf::Payload::Single include Msf::Payload::Solaris include...

Solaris Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 144 include Msf::Payload::Single include Msf::Payload::Solaris include...

Solaris Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 180 include Msf::Payload::Single include Msf::Payload::Solaris include...

Solaris Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 91 include Msf::Payload::Single include Msf::Payload::Solaris include...

Solaris Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 86 include Msf::Payload::Single include Msf::Payload::Solaris include...

Solaris Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 95 include Msf::Payload::Single include Msf::Payload::Solaris include...

OS X Command Shell, Find Tag Stager

Spawn a command shell staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework FindTag ------- OSX find tag stager. module MetasploitModule CachedSize = 76 include Msf::Payload::Stager def...

OS X Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 164 include Msf::Payload::Single include Msf::Payload::Osx include...

OS X Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- OSX reverse TCP stager. module MetasploitModule CachedSize = 100 include...

OS X Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 224 include Msf::Payload::Single include Msf::Payload::Osx include...

OS X Command Shell, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- OSX bind TCP stager. module MetasploitModule CachedSize = 152 include Msf::Payload::Stager def...

BSD Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 128 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 164 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSDi Command Shell, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- BSD bind TCP stager. module MetasploitModule CachedSize = 69 include Msf::Payload::Stager def...

BSDi Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- BSD reverse TCP stager. module MetasploitModule CachedSize = 59 include...

BSDi Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 77 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

BSDi Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 90 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

BSDi Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 77 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

BSD Command Shell, Find Tag Stager

Spawn a command shell staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework FindTag ------- BSD find tag stager. module MetasploitModule CachedSize = 40 include Msf::Payload::Stager def...