CA CAM log_security() Stack Buffer Overflow (Win32)

This module exploits a vulnerability in the CA CAM service by passing a long parameter to the logsecurity function. The CAM service is part of TNG Unicenter. This module has been tested on Unicenter v3.1. Module Options msf use exploit/windows/unicenter/cam/logsecurity msf undefinedlogsecurity sh...

Google Appliance ProxyStyleSheet Command Execution

This module exploits a feature in the Saxon XSLT parser used by the Google Search Appliance. This feature allows for arbitrary java methods to be called. Google released a patch and advisory to their client base in August of 2005 GA-2005-08-m. The target appliance must be able to connect back to...

eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in eDirectory 8.7.3 iMonitor service. This vulnerability was discovered by Peter Winter-Smith of NGSSoftware. NOTE: repeated exploitation attempts may cause eDirectory to crash. It does not restart automatically in a default installation. Module Option...

MS05-039 Microsoft Plug and Play Service Overflow

This module exploits a stack buffer overflow in the Windows Plug and Play service. This vulnerability can be exploited on Windows 2000 without a valid user account. NOTE: Since the PnP service runs inside the service.exe process, a failed exploit attempt will cause the system to automatically...

WordPress cache_lastpostdate Arbitrary Code Execution

This module exploits an arbitrary PHP code execution flaw in the WordPress blogging software. This vulnerability is only present when the PHP 'registerglobals' option is enabled common for hosting providers. All versions of WordPress prior to 1.5.1.3 are affected. Module Options msf use...

CA BrightStor Agent for Microsoft SQL Overflow

This module exploits a vulnerability in the CA BrightStor Agent for Microsoft SQL Server. This vulnerability was discovered by cybertronicatgmx.net. Module Options msf use exploit/windows/brightstor/sql/agent msf undefinedagent show actions ...actions... msf undefinedagent set ACTION msf...

Windows Upload/Execute, Find Tag Ordinal Stager

Uploads an executable and runs it staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Window...

Windows Inject DLL, Find Tag Ordinal Stager

Inject a custom DLL into the exploited process. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include...

VNC Server (Reflective Injection), Find Tag Ordinal Stager

Inject a VNC Dll via a reflective loader staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include...

Windows Command Shell, Find Tag Ordinal Stager

Spawn a piped command shell staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Windows def...

Windows Meterpreter (Reflective Injection), Find Tag Ordinal Stager

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModul...

Reflective DLL Injection, Find Tag Ordinal Stager

Inject a DLL via a reflective loader. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Windows de...

Windows Meterpreter (skape/jt Injection), Find Tag Ordinal Stager

Inject the meterpreter server DLL staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 92 include Msf::Payload::Stager include Msf::Payload::Window...

Sybase EAServer 5.2 Remote Stack Buffer Overflow

This module exploits a stack buffer overflow in the Sybase EAServer Web Console. The offset to the SEH frame appears to change depending on what version of Java is in use by the remote server, making this exploit somewhat unreliable. Module Options msf use exploit/windows/http/sybase/easerver msf...

SlimFTPd LIST Concatenation Overflow

This module exploits a stack buffer overflow in the SlimFTPd server. The flaw is triggered when a LIST command is received with an overly-long argument. This vulnerability affects all versions of SlimFTPd prior to 3.16 and was discovered by Raphael Rigo. Module Options msf use...

Linux Command Shell, Find Port Inline

Spawn a shell on an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 62 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends include...

Linux Mettle x86, Find Tag Stager

Inject the mettle server payload staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework FindTag ------- Linux find tag stager. module MetasploitModule CachedSize = 37 include...

Linux Command Shell, Find Tag Inline

Spawn a shell on an established connection proxy/nat safe This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 69 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends...

Linux Command Shell, Find Tag Stager

Spawn a command shell staged. Use an established connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework FindTag ------- Linux find tag stager. module MetasploitModule CachedSize = 37 include Msf::Payload::Stager...

Windows Meterpreter (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

Windows Command Shell, Reverse Ordinal TCP Stager (No NX or Win7)

Spawn a piped command shell staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows def...

VNC Server (Reflective Injection), Reverse Ordinal TCP Stager (No NX or Win7)

Inject a VNC Dll via a reflective loader staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include...

Windows Meterpreter (skape/jt Injection), Reverse Ordinal TCP Stager (No NX or Win7)

Inject the meterpreter server DLL staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows...

Windows Inject DLL, Reverse Ordinal TCP Stager (No NX or Win7)

Inject a custom DLL into the exploited process. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include...

Windows Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 328 include Msf::Payload::Windows include Msf::Payload::Single include...

Windows Upload/Execute, Reverse Ordinal TCP Stager (No NX or Win7)

Uploads an executable and runs it staged. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows...

Reflective DLL Injection, Reverse Ordinal TCP Stager (No NX or Win7)

Inject a DLL via a reflective loader. Connect back to the attacker This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 93 include Msf::Payload::Stager include Msf::Payload::Windows def...

Linux Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 78 include Msf::Payload::Single include Msf::Payload::Linux::X86::Prepends include...

Linux Mettle x86, Bind TCP Stager (Linux x86)

Inject the mettle server payload staged. Listen for a connection Linux x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 111 include Msf::Payload::Stager include...

Linux Command Shell, Bind TCP Stager (Linux x86)

Spawn a command shell staged. Listen for a connection Linux x86 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 111 include Msf::Payload::Stager include Msf::Payload::Linux::BindTc...

Linux Execute Command

Execute an arbitrary command or just a /bin/sh shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 43 include Msf::Payload::Single includ...

Linux Add User

Create a new user with UID 0 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework AddUser ------- Adds a UID 0 user to /etc/passwd. module MetasploitModule CachedSize = 97 include Msf::Payload::Single include...

Mozilla Suite/Firefox compareTo() Code Execution

This module exploits a code execution vulnerability in the Mozilla Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit module is a direct port of Aviv Raff's HTML PoC. Module Options msf use exploit/multi/browser/mozilla/compareto msf undefinedcompareto show actions...

MailEnable IMAPD (1.54) STATUS Request Buffer Overflow

MailEnable's IMAP server contains a buffer overflow vulnerability in the STATUS command. With proper credentials, this could allow for the execution of arbitrary code. Module Options msf use exploit/windows/imap/mailenable/status msf undefinedstatus show actions ...actions... msf undefinedstatus...

Windows Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 324 include Msf::Payload::Windows include Msf::Payload::Single include...

Windows Execute Command

Execute an arbitrary command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Executes a command on the target machine module MetasploitModule CachedSize = 192 include Msf::Payload::Windows::Exec end...

Windows Execute net user /ADD

Create a new user and add them to local administration group. Note: The specified password is checked for common complexity requirements to prevent the target machine rejecting the user for failing to meet policy requirements. Complexity check: 8-14 chars 1 UPPER, 1 lower, 1 digit/special This...

SoftiaCom WMailserver 1.0 Buffer Overflow

This module exploits a stack buffer overflow in SoftiaCom WMailserver 1.0 SMTP via a SEH frame overwrite. Module Options msf use exploit/windows/smtp/wmailserver msf undefinedwmailserver show actions ...actions... msf undefinedwmailserver set ACTION msf undefinedwmailserver show options ...show a...

Call+4 Dword XOR Encoder

Call+4 Dword XOR Encoder This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Call+4 Dword XOR Encoder', 'Description' = 'Call+4 Dword XOR Encoder', 'Author' = 'hdm', 'spoonm' , 'Arch' = ARCHX86,...

Jump/Call XOR Additive Feedback Encoder

Jump/Call XOR Additive Feedback This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Jump/Call XOR Additive Feedback Encoder', 'Description' = 'Jump/Call XOR Additive Feedback', 'Author' = 'skape',...

PHP XML-RPC Arbitrary Code Execution

This module exploits an arbitrary code execution flaw discovered in many implementations of the PHP XML-RPC module. This flaw is exploitable through a number of PHP web applications, including but not limited to Drupal, Wordpress, Postnuke, and TikiWiki. Module Options msf use...

Veritas Backup Exec Windows Remote Agent Overflow

This module exploits a stack buffer overflow in the Veritas BackupExec Windows Agent software. This vulnerability occurs when a client authentication request is received with type '3' and a long password argument. Reliable execution is obtained by abusing the stack buffer overflow to smash a SEH...

MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow

This module exploits a stack buffer overflow in the news reader of Microsoft Outlook Express. Module Options msf use exploit/windows/nntp/ms05/030nntp msf undefined030nntp show actions ...actions... msf undefined030nntp set ACTION msf undefined030nntp show options ...show and set options... msf...

FutureSoft TFTP Server 2000 Transfer-Mode Overflow

This module exploits a stack buffer overflow in the FutureSoft TFTP Server 2000 product. By sending an overly long transfer-mode string, we were able to overwrite both the SEH and the saved EIP. A subsequent write-exception that will occur allows the transferring of execution to our shellcode via...

Hummingbird Connectivity 10 SP5 LPD Buffer Overflow

This module exploits a stack buffer overflow in Hummingbird Connectivity 10 LPD Daemon. This module has only been tested against Hummingbird Exceed v10 with SP5. Module Options msf use exploit/windows/lpd/hummingbird/exceed msf undefinedexceed show actions ...actions... msf undefinedexceed set...

Berlios GPSD Format String Vulnerability

This module exploits a format string vulnerability in the Berlios GPSD server. This vulnerability was discovered by Kevin Finisterre. Module Options msf use exploit/linux/http/gpsd/formatstring msf undefinedformatstring show actions ...actions... msf undefinedformatstring set ACTION msf...

Novell ZENworks 6.5 Desktop/Server Management Overflow

This module exploits a heap overflow in the Novell ZENworks Desktop Management agent. This vulnerability was discovered by Alex Wheeler. Module Options msf use exploit/windows/novell/zenworks/desktopagent msf undefineddesktopagent show actions ...actions... msf undefineddesktopagent set ACTION ms...

Single Byte

Single-byte NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This class implements single-byte NOP generation for X86. It takes from ADMmutate and from spoonfu. class MetasploitModule nil , nop "\x97" =...

GlobalSCAPE Secure FTP Server Input Overflow

This module exploits a buffer overflow in the GlobalSCAPE Secure FTP Server. All versions prior to 3.0.3 are affected by this flaw. A valid user account or anonymous access is required for this exploit to work. Module Options msf use exploit/windows/ftp/globalscapeftp/input msf undefinedinput sho...

MaxDB WebDBM GET Buffer Overflow

This module exploits a stack buffer overflow in the MaxDB WebDBM service. This service is included with many recent versions of the MaxDB and SAPDB products. This particular module is capable of exploiting Windows systems through the use of an SEH frame overwrite. The offset to the SEH frame may...