BSD Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 60 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD Command Shell, Bind TCP Stager

Spawn a command shell staged. Listen for a connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework BindTcp ------- BSD bind TCP stager. module MetasploitModule CachedSize = 54 include Msf::Payload::Stager def...

BSD Command Shell, Reverse TCP Stager

Spawn a command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework ReverseTcp ---------- BSD reverse TCP stager. module MetasploitModule CachedSize = 43 include...

BSD Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 73 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD Execute Command

Execute an arbitrary command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 24 include Msf::Payload::Single include Msf::Payload::Bsd def...

BSD Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 64 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD Command Shell, Find Tag Inline

Spawn a shell on an established connection proxy/nat safe This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 70 include Msf::Payload::Single include Msf::Payload::Bsd include...

CA iTechnology iGateway Debug Mode Buffer Overflow

This module exploits a vulnerability in the Computer Associates iTechnology iGateway component. When True is enabled in igateway.conf non-default, it is possible to overwrite the stack and execute code remotely. This module works best with Ordinal payloads. Module Options msf use...

MailEnable IMAPD W3C Logging Buffer Overflow

This module exploits a buffer overflow in the W3C logging functionality of the MailEnable IMAPD service. Logging is not enabled by default and this exploit requires a valid username and password to exploit the flaw. MailEnable Professional version 1.6 and prior and MailEnable Enterprise version 1...

Opty2

Opty2 multi-byte NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/nop/opty2' Opty2 ----- This class implements single-byte NOP generation for X86. It takes from ADMmutate and from spoonfu...

TWiki History Function Arbitrary Command Execution

This module exploits a vulnerability in the history component of TWiki. By passing a 'rev' parameter containing shell metacharacters, an attacker can execute arbitrary OS commands. Affected versions: - 20040902 - 20040901 - 20030201 - 20011201 - 20001201 Module Options msf use...

Linksys WRT54 Access Point apply.cgi Buffer Overflow

This module exploits a stack buffer overflow in apply.cgi on the Linksys WRT54G and WRT54GS routers. According to iDefense who discovered this vulnerability, all WRT54G versions prior to 4.20.7 and all WRT54GS version prior to 1.05.2 may be affected. Module Options msf use...

Barracuda IMG.PL Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the Barracuda Spam Firewall appliance. Versions prior to 3.1.18 are vulnerable. Module Options msf use exploit/unix/webapp/barracuda/imgexec msf undefinedimgexec show actions ...actions... msf undefinedimgexec set ACTION msf...

HP Openview connectedNodes.ovpl Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the HP OpenView connectedNodes.ovpl CGI application. The results of the command will be displayed to the screen. Module Options msf use exploit/unix/webapp/openview/connectednodesexec msf undefinedconnectednodesexec show actions...

Simple PHP Blog Remote Command Execution

This module combines three separate issues within The Simple PHP Blog use exploit/unix/webapp/sphpblog/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf undefinedfileupload show options ...show and set options... msf undefinedfileupload run This...

CA CAM log_security() Stack Buffer Overflow (Win32)

This module exploits a vulnerability in the CA CAM service by passing a long parameter to the logsecurity function. The CAM service is part of TNG Unicenter. This module has been tested on Unicenter v3.1. Module Options msf use exploit/windows/unicenter/cam/logsecurity msf undefinedlogsecurity sh...

Google Appliance ProxyStyleSheet Command Execution

This module exploits a feature in the Saxon XSLT parser used by the Google Search Appliance. This feature allows for arbitrary java methods to be called. Google released a patch and advisory to their client base in August of 2005 GA-2005-08-m. The target appliance must be able to connect back to...

eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in eDirectory 8.7.3 iMonitor service. This vulnerability was discovered by Peter Winter-Smith of NGSSoftware. NOTE: repeated exploitation attempts may cause eDirectory to crash. It does not restart automatically in a default installation. Module Option...

WordPress cache_lastpostdate Arbitrary Code Execution

This module exploits an arbitrary PHP code execution flaw in the WordPress blogging software. This vulnerability is only present when the PHP 'registerglobals' option is enabled common for hosting providers. All versions of WordPress prior to 1.5.1.3 are affected. Module Options msf use...

MS05-039 Microsoft Plug and Play Service Overflow

This module exploits a stack buffer overflow in the Windows Plug and Play service. This vulnerability can be exploited on Windows 2000 without a valid user account. NOTE: Since the PnP service runs inside the service.exe process, a failed exploit attempt will cause the system to automatically...

CA BrightStor Agent for Microsoft SQL Overflow

This module exploits a vulnerability in the CA BrightStor Agent for Microsoft SQL Server. This vulnerability was discovered by cybertronicatgmx.net. Module Options msf use exploit/windows/brightstor/sql/agent msf undefinedagent show actions ...actions... msf undefinedagent set ACTION msf...

VNC Server (Reflective Injection), Find Tag Ordinal Stager

Inject a VNC Dll via a reflective loader staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include...

Windows Command Shell, Find Tag Ordinal Stager

Spawn a piped command shell staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Windows def...

Reflective DLL Injection, Find Tag Ordinal Stager

Inject a DLL via a reflective loader. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Windows de...

Windows Meterpreter (skape/jt Injection), Find Tag Ordinal Stager

Inject the meterpreter server DLL staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Window...

Windows Upload/Execute, Find Tag Ordinal Stager

Uploads an executable and runs it staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Window...

Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModul...

Windows Inject DLL, Find Tag Ordinal Stager

Inject a custom DLL into the exploited process. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include...

Sybase EAServer 5.2 Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in the Sybase EAServer Web Console. The offset to the SEH frame appears to change depending on what version of Java is in use by the remote server, making this exploit somewhat unreliable. Module Options msf use exploit/windows/http/sybase/easerver msf...

SlimFTPd LIST Concatenation Overflow

This module exploits a stack buffer overflow in the SlimFTPd server. The flaw is triggered when a LIST command is received with an overly-long argument. This vulnerability affects all versions of SlimFTPd prior to 3.16 and was discovered by Raphael Rigo. Module Options msf use...

Linux Command Shell, Find Tag Stager

Spawn a command shell staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework FindTag ------- Linux find tag stager. module MetasploitModule CachedSize = 37 include Msf::Payload::Stager...

Linux Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 62 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends include...

Linux Command Shell, Find Tag Inline

Spawn a shell on an established connection proxy/nat safe This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 69 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends...

Linux Mettle x86, Find Tag Stager

Inject the mettle server payload staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework FindTag ------- Linux find tag stager. module MetasploitModule CachedSize = 37 include...

Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)

Inject a custom DLL into the exploited process. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)

Inject the meterpreter server DLL staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows...

Windows Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 328 include Msf::Payload::Windows include Msf::Payload::Single include...

Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)

Inject a DLL via a reflective loader. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows def...

Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)

Uploads an executable and runs it staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows...

Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)

Inject a VNC Dll via a reflective loader staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include...

Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)

Spawn a piped command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows def...

Linux Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 78 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends include...

Linux Command Shell, Bind TCP Stager (Linux x86)

Spawn a command shell staged. Listen for a connection Linux x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 111 include Msf::Payload::Stager include Msf::Payload::Linux::BindTc...

Linux Mettle x86, Bind TCP Stager (Linux x86)

Inject the mettle server payload staged. Listen for a connection Linux x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 111 include Msf::Payload::Stager include...

Linux Add User

Create a new user with UID 0 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework AddUser ------- Adds a UID 0 user to /etc/passwd. module MetasploitModule CachedSize = 97 include Msf::Payload::Single include...

Linux Execute Command

Execute an arbitrary command or just a /bin/sh shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 43 include Msf::Payload::Single includ...

Mozilla Suite/Firefox compareTo() Code Execution

This module exploits a code execution vulnerability in the Mozilla Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit module is a direct port of Aviv Raff's HTML PoC. Module Options msf use exploit/multi/browser/mozilla/compareto msf undefinedcompareto show actions...

MailEnable IMAPD (1.54) STATUS Request Buffer Overflow

MailEnable's IMAP server contains a buffer overflow vulnerability in the STATUS command. With proper credentials, this could allow for the execution of arbitrary code. Module Options msf use exploit/windows/imap/mailenable/status msf undefinedstatus show actions ...actions... msf undefinedstatus...

Windows Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 324 include Msf::Payload::Windows include Msf::Payload::Single include...