ThinManager Path Traversal (CVE-2023-2915) Arbitrary File Delete

This module exploits a path traversal vulnerability CVE-2023-2915 in ThinManager use auxiliary/admin/networking/thinmanager/traversaldelete msf undefinedtraversaldelete show actions ...actions... msf undefinedtraversaldelete set ACTION msf undefinedtraversaldelete show options ...show and set...

Junos OS PHPRC Environment Variable Manipulation RCE

This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The...

Ivanti Avalanche MDM Buffer Overflow

This module exploits a buffer overflow condition in Ivanti Avalanche MDM versions before v6.4.1. An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in arbitrary code execution with the NT/AUTHORITY SYSTEM permissions. This vulnerability occurs...

PRTG CVE-2023-32781 Authenticated RCE

Authenticated RCE in Paessler PRTG Module Options msf use exploit/windows/http/prtg/authenticatedrcecve202332781 msf undefinedauthenticatedrcecve202332781 show actions ...actions... msf undefinedauthenticatedrcecve202332781 set ACTION msf undefinedauthenticatedrcecve202332781 show options ...show...

CrushFTP Unauthenticated RCE

This exploit module leverages an Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability CVE-2023-43177 to achieve unauthenticated remote code execution. This affects CrushFTP versions prior to 10.5.1. It is possible to set some user's session properties by...

LG Simple Editor Command Injection (CVE-2023-40504)

Unauthenticated Command Injection in LG Simple Editor use exploit/windows/http/lg/simpleeditorrceuploadvideo msf undefinedsimpleeditorrceuploadvideo show actions ...actions... msf undefinedsimpleeditorrceuploadvideo set ACTION msf undefinedsimpleeditorrceuploadvideo show options ...show and set...

Unix SSH Shell, Bind Instance Connect (via AWS API)

Creates an SSH shell using AWS Instance Connect Module Options msf use payload/cmd/unix/bindawsinstanceconnect msf payloadbindawsinstanceconnect show actions ...actions... msf payloadbindawsinstanceconnect set ACTION msf payloadbindawsinstanceconnect show options ...show and set options... msf...

OSX Meterpreter, Reverse HTTPS Inline

Run the Meterpreter / Mettle server payload stageless Module Options msf use payload/osx/aarch64/meterpreterreversehttps msf payloadmeterpreterreversehttps show actions ...actions... msf payloadmeterpreterreversehttps set ACTION msf payloadmeterpreterreversehttps show options ...show and set...

OSX Meterpreter, Reverse TCP Inline

Run the Meterpreter / Mettle server payload stageless Module Options msf use payload/osx/aarch64/meterpreterreversetcp msf payloadmeterpreterreversetcp show actions ...actions... msf payloadmeterpreterreversetcp set ACTION msf payloadmeterpreterreversetcp show options ...show and set options... m...

OSX Meterpreter, Reverse TCP Stager

Inject the mettle server payload staged. Connect back to the attacker Module Options msf use payload/osx/aarch64/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set options... msf...

OSX Meterpreter, Reverse HTTP Inline

Run the Meterpreter / Mettle server payload stageless Module Options msf use payload/osx/aarch64/meterpreterreversehttp msf payloadmeterpreterreversehttp show actions ...actions... msf payloadmeterpreterreversehttp set ACTION msf payloadmeterpreterreversehttp show options ...show and set options...

Eramba (up to 3.19.1) Authenticated Remote Code Execution Module

This module exploits a remote code execution vulnerability in Eramba. An authenticated user can execute arbitrary commands on the server by exploiting the path parameter in the download-test-pdf endpoint. Eramba debug mode has to be enabled. Module Options msf use exploit/linux/http/eramba/rce ms...

RaspAP Unauthenticated Command Injection

RaspAP is feature-rich wireless router software that just works on many popular Debian-based devices, including the Raspberry Pi. A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands in the context of the user running...

Maltrail Unauthenticated Command Injection

Maltrail is a malicious traffic detection system, utilizing publicly available blacklists containing malicious and/or generally suspicious trails. The Maltrail versions use exploit/unix/http/maltrail/rce msf undefinedrce show actions ...actions... msf undefinedrce set ACTION msf undefinedrce show...

GameOver(lay) Privilege Escalation and Container Escape

This module exploits the use of unsafe functions in a number of Ubuntu kernels utilizing vulnerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux kernel added a call to vfssetxattr during ovldosetxattr. Due to independent changes to the kernel by the Ubuntu development team...

Greenshot .NET Deserialization Fileformat Exploit

There exists a .NET deserialization vulnerability in Greenshot version 1.3.274 and below. The deserialization allows the execution of commands when a user opens a Greenshot file. The commands execute under the same permissions as the Greenshot service. Typically, is the logged in user. Module...

Metabase Setup Token RCE

Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token is accessible even after the setup process has been completed. With this token a user is able to submit the setup functionality to create a new database. When creating a new database, an H2 database string is created wi...

Citrix ADC (NetScaler) Forms SSO Target RCE

A vulnerability exists within Citrix ADC that allows an unauthenticated attacker to trigger a stack buffer overflow of the nsppe process by making a specially crafted HTTP GET request. Successful exploitation results in remote code execution as root. Module Options msf use...

BoidCMS Command Injection

This module leverages CVE-2023-38836, an improper sanitization bug in BoidCMS version 2.0.0 and below. BoidCMS allows the authenticated upload of a php file as media if the file has the GIF header, even if the file is a php file. Module Options msf use exploit/multi/http/cve/202338836boidcms msf...

Sonicwall

This module exploits a series of vulnerabilities - including auth bypass, SQL injection, and shell injection - to obtain remote code execution on SonicWall GMS versions use exploit/multi/http/sonicwall/shellinjectioncve202334124 msf undefinedshellinjectioncve202334124 show actions ...actions... m...

Microsoft Error Reporting Local Privilege Elevation Vulnerability

This module takes advantage of a bug in the way Windows error reporting opens the report parser. If you open a report, Windows uses a relative path to locate the rendering program. By creating a specific alternate directory structure, we can coerce Windows into opening an arbitrary executable as...

OpenTSDB 2.4.1 unauthenticated command injection

This module exploits an unauthenticated command injection vulnerability in the key parameter in OpenTSDB through 2.4.1 CVE-2023-36812/CVE-2023-25826 in order to achieve unauthenticated remote code execution as the root user. The module first attempts to obtain the OpenTSDB version via the api. If...

OpenNMS Horizon Authenticated RCE

This module exploits built-in functionality in OpenNMS Horizon in order to execute arbitrary commands as the opennms user. For versions 32.0.2 and higher, this module requires valid credentials for a user with ROLEFILESYSTEMEDITOR privileges and either ROLEADMIN or ROLEREST. For versions 32.0.1 a...

MagnusBilling application unauthenticated Remote Command Execution.

A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. A piece of demonstration code is present in lib/icepay/icepay.php, with a call to an exec. The parameter to exec includes the GET paramete...

Rudder Server SQLI Remote Code Execution

This Metasploit module exploits a SQL injection vulnerability in RudderStack's rudder-server, an open source Customer Data Platform CDP. The vulnerability exists in versions of rudder-server prior to 1.3.0-rc.1. By exploiting this flaw, an attacker can execute arbitrary SQL commands, which may le...

TFTP Fetch, Bind TCP Stager

Fetch and execute a x86 payload from a TFTP server. Listen for a connection Module Options msf use payload/cmd/linux/tftp/x86/meterpreter/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options ...show and set options...

HTTPS Fetch, Linux Command Shell, Bind TCP Stager with UUID Support (Linux x86)

Fetch and execute an x86 payload from an HTTPS server. Spawn a command shell staged. Listen for a connection with UUID Support Linux x86 Module Options msf use payload/cmd/linux/https/x86/shell/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set ACTION msf...

HTTP Fetch, Linux Command Shell, Reverse TCP Inline (IPv6)

Fetch and execute a x86 payload from an HTTP server. Connect back to attacker and spawn a command shell over IPv6 Module Options msf use payload/cmd/linux/http/x86/shellreversetcpipv6 msf payloadshellreversetcpipv6 show actions ...actions... msf payloadshellreversetcpipv6 set ACTION msf...

HTTPS Fetch, Linux Execute Command

Fetch and execute an x86 payload from an HTTPS server. Execute an arbitrary command or just a /bin/sh shell Module Options msf use payload/cmd/linux/https/x86/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options ...show and set options... msf...

HTTP Fetch, Bind TCP Stager with UUID Support (Linux x86)

Fetch and execute a x86 payload from an HTTP server. Listen for a connection with UUID Support Linux x86 Module Options msf use payload/cmd/linux/http/x86/meterpreter/bindtcpuuid msf payloadbindtcpuuid show actions ...actions... msf payloadbindtcpuuid set ACTION msf payloadbindtcpuuid show option...

HTTPS Fetch, Linux Read File

Fetch and execute an x86 payload from an HTTPS server. Read up to 4096 bytes from the local file system and write it back out to the specified file descriptor Module Options msf use payload/cmd/linux/https/x86/readfile msf payloadreadfile show actions ...actions... msf payloadreadfile set ACTION...

TFTP Fetch, Generic x86 Debug Trap

Fetch and execute a x86 payload from a TFTP server. Generate a debug trap in the target process Module Options msf use payload/cmd/linux/tftp/x86/generic/debugtrap msf payloaddebugtrap show actions ...actions... msf payloaddebugtrap set ACTION msf payloaddebugtrap show options ...show and set...

HTTPS Fetch, Linux Command Shell, Reverse TCP Inline

Fetch and execute an x86 payload from an HTTPS server. Connect back to attacker and spawn a command shell Module Options msf use payload/cmd/linux/https/x86/shellreversetcp msf payloadshellreversetcp show actions ...actions... msf payloadshellreversetcp set ACTION msf payloadshellreversetcp show...

TFTP Fetch, Reverse TCP Stager

Fetch and execute a x86 payload from a TFTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/tftp/x86/meterpreter/reversetcpuuid msf payloadreversetcpuuid show actions ...actions... msf payloadreversetcpuuid set ACTION msf payloadreversetcpuuid show options ...show an...

TFTP Fetch, Reverse TCP Stager

Fetch and execute a x86 payload from a TFTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/tftp/x86/meterpreter/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options ...show and set options...

TFTP Fetch, Reverse TCP Stager (IPv6)

Fetch and execute a x86 payload from a TFTP server. Connect back to attacker over IPv6 Module Options msf use payload/cmd/linux/tftp/x86/meterpreter/reverseipv6tcp msf payloadreverseipv6tcp show actions ...actions... msf payloadreverseipv6tcp set ACTION msf payloadreverseipv6tcp show options...

TFTP Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)

Fetch and execute a x86 payload from a TFTP server. Spawn a command shell staged. Listen for a connection Linux x86 Module Options msf use payload/cmd/linux/tftp/x86/shell/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...show a...

HTTPS Fetch, Linux Command Shell, Bind IPv6 TCP Stager (Linux x86)

Fetch and execute an x86 payload from an HTTPS server. Spawn a command shell staged. Listen for an IPv6 connection Linux x86 Module Options msf use payload/cmd/linux/https/x86/shell/bindipv6tcp msf payloadbindipv6tcp show actions ...actions... msf payloadbindipv6tcp set ACTION msf...

HTTP Fetch, Linux Command Shell, Reverse TCP Stager

Fetch and execute a x86 payload from an HTTP server. Spawn a command shell staged. Connect back to the attacker Module Options msf use payload/cmd/linux/http/x86/shell/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show options...

TFTP Fetch, Linux Command Shell, Bind TCP Inline (IPv6)

Fetch and execute a x86 payload from a TFTP server. Listen for a connection over IPv6 and spawn a command shell Module Options msf use payload/cmd/linux/tftp/x86/shellbindipv6tcp msf payloadshellbindipv6tcp show actions ...actions... msf payloadshellbindipv6tcp set ACTION msf...

HTTP Fetch, Linux Command Shell, Bind TCP Stager

Fetch and execute a x86 payload from an HTTP server. Spawn a command shell staged. Listen for a connection Module Options msf use payload/cmd/linux/http/x86/shell/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options...

TFTP Fetch, Linux Command Shell, Bind TCP Stager

Fetch and execute a x86 payload from a TFTP server. Spawn a command shell staged. Listen for a connection Module Options msf use payload/cmd/linux/tftp/x86/shell/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options...

TFTP Fetch, Linux Command Shell, Bind TCP Random Port Inline

Fetch and execute a x86 payload from a TFTP server. Listen for a connection in a random port and spawn a command shell. Use nmap to discover the open port: 'nmap -sS target -p-'. Module Options msf use payload/cmd/linux/tftp/x86/shellbindtcprandomport msf payloadshellbindtcprandomport show action...

HTTP Fetch, Linux Command Shell, Find Tag Inline

Fetch and execute a x86 payload from an HTTP server. Spawn a shell on an established connection proxy/NAT safe Module Options msf use payload/cmd/linux/http/x86/shellfindtag msf payloadshellfindtag show actions ...actions... msf payloadshellfindtag set ACTION msf payloadshellfindtag show options...

TFTP Fetch, Linux Execute Command

Fetch and execute a x86 payload from a TFTP server. Execute an arbitrary command or just a /bin/sh shell Module Options msf use payload/cmd/linux/tftp/x86/exec msf payloadexec show actions ...actions... msf payloadexec set ACTION msf payloadexec show options ...show and set options... msf...

HTTPS Fetch, Linux Meterpreter Service, Bind TCP

Fetch and execute an x86 payload from an HTTPS server. Stub payload for interacting with a Meterpreter Service Module Options msf use payload/cmd/linux/https/x86/metsvcbindtcp msf payloadmetsvcbindtcp show actions ...actions... msf payloadmetsvcbindtcp set ACTION msf payloadmetsvcbindtcp show...

HTTPS Fetch, Linux Command Shell, Bind TCP Stager (Linux x86)

Fetch and execute an x86 payload from an HTTPS server. Spawn a command shell staged. Listen for a connection Linux x86 Module Options msf use payload/cmd/linux/https/x86/shell/bindtcp msf payloadbindtcp show actions ...actions... msf payloadbindtcp set ACTION msf payloadbindtcp show options ...sh...

HTTP Fetch, Reverse TCP Stager

Fetch and execute a x86 payload from an HTTP server. Connect back to the attacker Module Options msf use payload/cmd/linux/http/x86/meterpreter/reversenonxtcp msf payloadreversenonxtcp show actions ...actions... msf payloadreversenonxtcp set ACTION msf payloadreversenonxtcp show options ...show a...

TFTP Fetch, Generic x86 Tight Loop

Fetch and execute a x86 payload from a TFTP server. Generate a tight loop in the target process Module Options msf use payload/cmd/linux/tftp/x86/generic/tightloop msf payloadtightloop show actions ...actions... msf payloadtightloop set ACTION msf payloadtightloop show options ...show and set...

HTTPS Fetch, Linux Command Shell, Bind TCP Stager

Fetch and execute an x86 payload from an HTTPS server. Spawn a command shell staged. Listen for a connection Module Options msf use payload/cmd/linux/https/x86/shell/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options...