NetTerm NetFTPD USER Buffer Overflow

This module exploits a vulnerability in the NetTerm NetFTPD application. This package is part of the NetTerm package. This module uses the USER command to trigger the overflow. Module Options msf use exploit/windows/ftp/netterm/netftpduser msf undefinednetftpduser show actions ...actions... msf...

MailEnable Authorization Header Buffer Overflow

This module exploits a remote buffer overflow in the MailEnable web service. The vulnerability is triggered when a large value is placed into the Authorization header of the web request. MailEnable Enterprise Edition versions prior to 1.0.5 and MailEnable Professional versions prior to 1.55 are...

Oracle DB SQL Injection via SYS.DBMS_CDC_SUBSCRIBE.ACTIVATE_SUBSCRIPTION

This module will escalate an Oracle DB user to DBA by exploiting a sql injection bug in the SYS.DBMSCDCSUBSCRIBE.ACTIVATESUBSCRIPTION package/function. This vulnerability affects to Oracle Database Server 9i up to 9.2.0.5 and 10g up to 10.1.0.4. Module Options msf use...

MS05-017 Microsoft Message Queueing Service Path Overflow

This module exploits a stack buffer overflow in the RPC interface to the Microsoft Message Queueing service. The offset to the return address changes based on the length of the system hostname, so this must be provided via the 'HNAME' option. Much thanks to snort.org and Jean-Baptiste Marchand's...

GLD (Greylisting Daemon) Postfix Buffer Overflow

This module exploits a stack buffer overflow in the Salim Gasmi GLD use exploit/linux/misc/gld/postfix msf undefinedpostfix show actions ...actions... msf undefinedpostfix set ACTION msf undefinedpostfix show options ...show and set options... msf undefinedpostfix run This module requires...

CA BrightStor Universal Agent Overflow

This module exploits a convoluted heap overflow in the CA BrightStor Universal Agent service. Triple userland exception results in heap growth and execution of dereferenced function pointer at a specified address. Module Options msf use exploit/windows/brightstor/universal/agent msf undefinedagen...

BakBone NetVault Remote Heap Overflow

This module exploits a heap overflow in the BakBone NetVault Process Manager service. This code is a direct port of the netvault.c code written by nolimit and BuzzDee. Module Options msf use exploit/windows/misc/bakbone/netvaultheap msf undefinednetvaultheap show actions ...actions... msf...

GoodTech Telnet Server Buffer Overflow

This module exploits a stack buffer overflow in GoodTech Systems Telnet Server versions prior to 5.0.7. By sending an overly long string, an attacker can overwrite the buffer and control program execution. Module Options msf use exploit/windows/telnet/goodtech/telnet msf undefinedtelnet show...

SentinelLM UDP Buffer Overflow

This module exploits a simple stack buffer overflow in the Sentinel License Manager. The SentinelLM service is installed with a wide selection of products and seems particular popular with academic products. If the wrong target value is selected, the service will crash and not restart. Module...

Computer Associates License Client GETCONFIG Overflow

This module exploits a vulnerability in the CA License Client service. This exploit will only work if your IP address can be resolved from the target system point of view. This can be accomplished on a local network by running the 'nmbd' service that comes with Samba. If you are running this...

Computer Associates License Server GETCONFIG Overflow

This module exploits an vulnerability in the CA License Server network service. By sending an excessively long GETCONFIG packet the stack may be overwritten. Module Options msf use exploit/windows/license/calicserv/getconfig msf undefinedgetconfig show actions ...actions... msf undefinedgetconfig...

CA BrightStor ARCserve License Service GCR NETWORK Buffer Overflow

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup 11.0. By sending a specially crafted request to the lic98rmtd.exe service, an attacker could overflow the buffer and execute arbitrary code. Module Options msf use exploit/windows/brightstor/license/gcr...

RealNetworks RealPlayer SMIL Buffer Overflow

This module exploits a stack buffer overflow in RealNetworks RealPlayer 10 and 8. By creating a URL link to a malicious SMIL file, a remote attacker could overflow a buffer and execute arbitrary code. When using this module, be sure to set the URIPATH with an extension of '.smil'. This module has...

vBulletin misc.php Template Name Arbitrary Code Execution

This module exploits an arbitrary PHP code execution flaw in the vBulletin web forum software. This vulnerability is only present when the "Add Template Name in HTML Comments" option is enabled. All versions of vBulletin prior to 3.0.7 are affected. Module Options msf use...

Arkeia Backup Client Type 77 Overflow (Mac OS X)

This module exploits a stack buffer overflow in the Arkeia backup client for the Mac OS X platform. This vulnerability affects all versions up to and including 5.3.3 and has been tested with Arkeia 5.3.1 on Mac OS X 10.3.5. Module Options msf use exploit/osx/arkeia/type77 msf undefinedtype77 show...

TrackerCam PHP Argument Buffer Overflow

This module exploits a simple stack buffer overflow in the TrackerCam web server. All current versions of this software are vulnerable to a large number of security issues. This module abuses the directory traversal flaw to gain information about the system and then uses the PHP overflow to execu...

Arkeia Backup Client Type 77 Overflow (Win32)

This module exploits a stack buffer overflow in the Arkeia backup client for the Windows platform. This vulnerability affects all versions up to and including 5.3.3. Module Options msf use exploit/windows/arkeia/type77 msf undefinedtype77 show actions ...actions... msf undefinedtype77 set ACTION...

CA BrightStor Discovery Service TCP Overflow

This module exploits a vulnerability in the CA BrightStor Discovery Service. This vulnerability occurs when a specific type of request is sent to the TCP listener on port 41523. This vulnerability was discovered by cybertronicatgmx.net and affects all known versions of the BrightStor product. Thi...

Oracle URL Download

This module will create a Java class which enables the download of a binary from a webserver to the Oracle filesystem. Module Options msf use auxiliary/admin/oracle/post/exploitation/win32upload msf undefinedwin32upload show actions ...actions... msf undefinedwin32upload set ACTION msf...

URSoft W32Dasm Disassembler Function Buffer Overflow

This module exploits a buffer overflow in W32Dasm use exploit/windows/fileformat/ursoft/w32dasm msf undefinedw32dasm show actions ...actions... msf undefinedw32dasm set ACTION msf undefinedw32dasm show options ...show and set options... msf undefinedw32dasm run This module requires Metasploit:...

AWStats configdir Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the AWStats CGI script. iDEFENSE has confirmed that AWStats versions 6.1 and 6.2 are vulnerable. Module Options msf use exploit/unix/webapp/awstats/configdirexec msf undefinedconfigdirexec show actions ...actions... msf...

Cacti graph_view.php Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the Raxnet Cacti 'graphview.php' script. All versions of Raxnet Cacti prior to 0.8.6-d are vulnerable. Module Options msf use exploit/unix/webapp/cacti/graphimageexec msf undefinedgraphimageexec show actions ...actions... msf...

Apple ITunes 4.7 Playlist Buffer Overflow

This module exploits a stack buffer overflow in Apple ITunes 4.7 build 4.7.0.42. By creating a URL link to a malicious PLS file, a remote attacker could overflow a buffer and execute arbitrary code. When using this module, be sure to set the URIPATH with an extension of '.pls'. Module Options msf...

Blue Coat WinProxy Host Header Overflow

This module exploits a buffer overflow in the Blue Coat Systems WinProxy service by sending a long port value for the Host header in a HTTP request. Module Options msf use exploit/windows/proxy/bluecoat/winproxyhost msf undefinedwinproxyhost show actions ...actions... msf undefinedwinproxyhost se...

3Com 3CDaemon 2.0 FTP Username Overflow

This module exploits a vulnerability in the 3Com 3CDaemon FTP service. This package is being distributed from the 3Com web site and is recommended in numerous support documents. This module uses the USER command to trigger the overflow. Module Options msf use exploit/windows/ftp/3cdaemon/ftpuser...

Microsoft IIS WebDAV Write Access Code Execution

This module can be used to execute a payload on IIS servers that have world-writeable directories. The payload is uploaded as an ASP script via a WebDAV PUT request. The target IIS machine must meet these conditions to be considered as exploitable: It allows 'Script resource access', Read and Wri...

Serv-U FTP Server Buffer Overflow

This module exploits a stack buffer overflow in the site chmod command in versions of Serv-U FTP Server prior to 4.2. You must have valid credentials to trigger this vulnerability. Exploitation also leaves the service in a non-functional state. Module Options msf use exploit/windows/ftp/servu/chm...

Netcat v1.10 NT Stack Buffer Overflow

This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending an overly long string we are able to overwrite SEH. The vulnerability exists when netcat is used to bind -e an executable to a port in doexec.c. This module tested successfully using "c:\nc -L -p 31337 -e ftp". Module...

SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow

This module exploits a format string vulnerability in the Nullsoft SHOUTcast server for Windows. The vulnerability is triggered by requesting a file path that contains format string specifiers. This vulnerability was discovered by Tomasz Trojanowski and Damian Put. Module Options msf use...

CA BrightStor Discovery Service Stack Buffer Overflow

This module exploits a vulnerability in the CA BrightStor Discovery Service. This vulnerability occurs when a large request is sent to UDP port 41524, triggering a stack buffer overflow. Module Options msf use exploit/windows/brightstor/discovery/udp msf undefinedudp show actions ...actions... ms...

Veritas Backup Exec Name Service Overflow

This module exploits a vulnerability in the Veritas Backup Exec Agent Browser service. This vulnerability occurs when a recv call has a length value too long for the destination stack buffer. By sending an agent name value of 63 bytes or more, we can overwrite the return address of the recv...

MS04-045 Microsoft WINS Service Memory Overwrite

This module exploits an arbitrary memory write flaw in the WINS service. This exploit has been tested against Windows 2000 only. Module Options msf use exploit/windows/wins/ms04/045wins msf undefined045wins show actions ...actions... msf undefined045wins set ACTION msf undefined045wins show optio...

Microsoft IIS ISAPI w3who.dll Query String Overflow

This module exploits a stack buffer overflow in the w3who.dll ISAPI application. This vulnerability was discovered Nicolas Gregoire and this code has been successfully tested against Windows 2000 and Windows XP SP2. When exploiting Windows XP, the payload must call RevertToSelf before it will be...

Mercury/32 v4.01a IMAP RENAME Buffer Overflow

This module exploits a stack buffer overflow vulnerability in the Mercury/32 v.4.01a IMAP service. Module Options msf use exploit/windows/imap/mercury/rename msf undefinedrename show actions ...actions... msf undefinedrename set ACTION msf undefinedrename show options ...show and set options... m...

WS-FTP Server 5.03 MKD Overflow

This module exploits the buffer overflow found in the MKD command in IPSWITCH WSFTP Server 5.03 discovered by Reed Arvin. Module Options msf use exploit/windows/ftp/wsftp/server503mkd msf undefinedserver503mkd show actions ...actions... msf undefinedserver503mkd set ACTION msf undefinedserver503m...

Mdaemon 8.0.3 IMAPD CRAM-MD5 Authentication Overflow

This module exploits a buffer overflow in the CRAM-MD5 authentication of the MDaemon IMAP service. This vulnerability was discovered by Muts. Module Options msf use exploit/windows/imap/mdaemon/crammd5 msf undefinedcrammd5 show actions ...actions... msf undefinedcrammd5 set ACTION msf...

MS06-019 Exchange MODPROP Heap Overflow

This module triggers a heap overflow vulnerability in MS Exchange that occurs when multiple malformed MODPROP values occur in a VCAL request. Module Options msf use auxiliary/dos/windows/smtp/ms06/019exchange msf undefined019exchange show actions ...actions... msf undefined019exchange set ACTION...

phpBB viewtopic.php Arbitrary Code Execution

This module exploits two arbitrary PHP code execution flaws in the phpBB forum system. The problem is that the 'highlight' parameter in the 'viewtopic.php' script is not verified properly and will allow an attacker to inject arbitrary code via pregreplace. This vulnerability was introduced in...

IMail IMAP4D Delete Overflow

This module exploits a buffer overflow in the 'DELETE' command of the IMail IMAP4D service. This vulnerability can only be exploited with a valid username and password. This flaw was patched in version 8.14. Module Options msf use exploit/windows/imap/imail/delete msf undefineddelete show actions...

CCProxy Telnet Proxy Ping Overflow

This module exploits the YoungZSoft CCProxy use exploit/windows/proxy/ccproxy/telnetping msf undefinedtelnetping show actions ...actions... msf undefinedtelnetping set ACTION msf undefinedtelnetping show options ...show and set options... msf undefinedtelnetping run This module requires Metasploi...

Minishare 1.4.1 Buffer Overflow

This is a simple buffer overflow for the minishare web server. This flaw affects all versions prior to 1.4.2. This is a plain stack buffer overflow that requires a "jmp esp" to reach the payload, making this difficult to target many platforms at once. This module has been successfully tested...

TABS MailCarrier v2.51 SMTP EHLO Overflow

This module exploits the MailCarrier v2.51 suite SMTP service. The stack is overwritten when sending an overly long EHLO command. Module Options msf use exploit/windows/smtp/mailcarrier/smtpehlo msf undefinedsmtpehlo show actions ...actions... msf undefinedsmtpehlo set ACTION msf undefinedsmtpehl...

Ability Server 2.34 STOR Command Stack Buffer Overflow

This module exploits a stack-based buffer overflow in Ability Server 2.34. Ability Server fails to check input size when parsing 'STOR' and 'APPE' commands, which leads to a stack based buffer overflow. This plugin uses the 'STOR' command. The vulnerability has been confirmed on version 2.34 and...

VERITAS NetBackup Remote Command Execution

This module allows arbitrary command execution on an ephemeral port opened by Veritas NetBackup, whilst an administrator is authenticated. The port is opened and allows direct console access as root or SYSTEM from any source address. Module Options msf use...

MS04-031 Microsoft NetDDE Service Overflow

This module exploits a stack buffer overflow in the NetDDE service, which is the precursor to the DCOM interface. This exploit effects only operating systems released prior to Windows XP SP1 2000 SP4, XP SP0. Despite Microsoft's claim that this vulnerability can be exploited without authenticatio...

ShixxNOTE 6.net Font Field Overflow

This module exploits a buffer overflow in ShixxNOTE 6.net. The vulnerability is caused due to boundary errors in the handling of font fields. Module Options msf use exploit/windows/misc/shixxnote/font msf undefinedfont show actions ...actions... msf undefinedfont set ACTION msf undefinedfont show...

TWiki Search Function Arbitrary Command Execution

This module exploits a vulnerability in the search component of TWiki. By passing a 'search' parameter containing shell metacharacters to a 'Search' script, an attacker can execute arbitrary OS commands. Affected versions: - 20040901 - 20030201 - 20011201 - 20001201 - SVN up to and including...

Icecast Header Overwrite

This module exploits a buffer overflow in the header parsing of icecast versions 2.0.1 and earlier, discovered by Luigi Auriemma. Sending 32 HTTP headers will cause a write one past the end of a pointer array. On win32 this happens to overwrite the saved instruction pointer, and on linux dependin...

YPOPS 0.6 Buffer Overflow

This module exploits a stack buffer overflow in the YPOPS POP3 service. This is a classic stack buffer overflow for YPOPS version 0.6. Possibly Affected version 0.5, 0.4.5.1, 0.4.5. Eip point to jmp ebx opcode in ws32.dll Module Options msf use exploit/windows/smtp/ypops/overflow1 msf...

Motorola WR850G v4.03 Credentials

Login credentials to the Motorola WR850G router with firmware v4.03 can be obtained via a simple GET request if issued while the administrator is logged in. A lot more information is available through this request, but you can get it all and more after logging in. Module Options msf use...