elFinder Archive Command Injection

elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT...

Wordpress Popular Posts Authenticated RCE

This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080. The FQDN must also not resolve to a reserved address 192/172/127/10. The server must also respond to a HEAD request for the payload, prior to getting a GET request. This exploit...

Print Spooler Remote DLL Injection

The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN vector which requires the Print Spooler service to be running. Module Options msf use...

Polkit D-Bus Authentication Bypass

A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a method over D-Bus and kills the client process. This will occasionally cause the operati...

Selenium Grid/Selenoid Unauthenticated RCE

Selenium Grid and Selenoid expose a WebDriver API that allows creating browser sessions with arbitrary capabilities. When deployed without authentication the default for both, an attacker can achieve remote code execution through two browser-specific techniques: For Chrome, the goog:chromeOptions...

Squid Proxy Range Header DoS

The range handler in The Squid Caching Proxy Server 3.0-4.1.4 and 5.0.1-5.0.5 suffers from multiple vulnerabilities triggered by specific HTTP requests and responses. These vulnerabilities allow remote attackers to cause a denial of service through specifically crafted requests. Module Options ms...

Git Ignore Retriever

This module finds potentially sensitive items by finding .gitignore files. Module Options msf use post/osx/gather/gitignore msf postgitignore show actions ...actions... msf postgitignore set ACTION msf postgitignore show options ...show and set options... msf postgitignore run class...

VMware vCenter Server Virtual SAN Health Check Plugin RCE

This module exploits Java unsafe reflection and SSRF in the VMware vCenter Server Virtual SAN Health Check plugin's ProxygenController class to execute code as the vsphere-ui user. See the vendor advisory for affected and patched versions. Tested against VMware vCenter Server 6.7 Update 3m Linux...

ExifTool DjVu ANT Perl injection

This module exploits a Perl injection vulnerability in the DjVu ANT parsing code of ExifTool versions 7.44 through 12.23 inclusive. The injection is used to execute a shell command using Perl backticks. The DjVu image can be embedded in a wrapper image using the HasselbladExif EXIF field. Module...

SaltStack Salt Information Gatherer

This module gathers information from SaltStack Salt masters and minions. Data gathered from minions: 1. salt minion config file Data gathered from masters: 1. minion list denied, pre, rejected, accepted 2. minion hostname/ip/os depending on module settings 3. SLS 4. roster, any SSH keys are...

HashiCorp Nomad Remote Command Execution

Create a batch job on HashiCorp's Nomad service to spawn a shell. The default option is to use the 'rawexec' driver, which runs with high privileges. Development servers and client's explicitly enabling the 'rawexec' plugin can spawn these type of jobs. Regular 'exec' jobs can be created in a...

IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE

This module exploits an authenticated command injection vulnerability in the /cgi-bin/pakfire.cgi web page of IPFire devices running versions 2.25 Core Update 156 and prior to execute arbitrary code as the root user. Module Options msf use exploit/linux/http/ipfire/pakfireexec msf...

Linux eBPF ALU32 32-bit Invalid Bounds Tracking LPE

Linux kernels from 5.7-rc1 prior to 5.13-rc4, 5.12.4, 5.11.21, and 5.10.37 are vulnerable to a bug in the eBPF verifier's verification of ALU32 operations in the scalar32minmaxand function when performing AND operations, whereby under certain conditions the bounds of a 32 bit register would not b...

Windows IIS HTTP Protocol Stack DOS

This module exploits CVE-2021-31166, a UAF bug in http.sys when parsing specially crafted Accept-Encoding headers that was patched by Microsoft in May 2021, on vulnerable IIS servers. Successful exploitation will result in the target computer BSOD'ing before subsequently rebooting. Note that the...

Microsoft SharePoint Unsafe Control and ViewState RCE

The EditingPageParser.VerifyControlOnSafeList method fails to properly validate user supplied data. This can be leveraged by an attacker to leak sensitive information in rendered-preview content. This module will leak the ViewState validation key and then use it to sign a crafted object that will...

Apache 2.4.49/2.4.50 Traversal RCE

This module exploit an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 CVE-2021-41773. If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled, it can be used to execute arbitrary commands Remote Command Execution...

Apache 2.4.49/2.4.50 Traversal RCE scanner

This module scans for an unauthenticated RCE vulnerability which exists in Apache version 2.4.49 CVE-2021-41773. If files outside of the document root are not protected by 'require all denied' and CGI has been explicitly enabled, it can be used to execute arbitrary commands Remote Command...

Cisco HyperFlex HX Data Platform Command Execution

This module exploits an unauthenticated command injection in Cisco HyperFlex HX Data Platform's /storfs-asup endpoint to execute shell commands as the Tomcat user. Module Options msf use exploit/linux/http/cisco/hyperflexhxdataplatformcmdexec msf undefinedhyperflexhxdataplatformcmdexec show actio...

Cisco HyperFlex HX Data Platform unauthenticated file upload to RCE (CVE-2021-1499)

This module exploits an unauthenticated file upload vulnerability in Cisco HyperFlex HX Data Platform's /upload endpoint to upload and execute a payload as the Tomcat user. Module Options msf use exploit/linux/http/cisco/hyperflexfileuploadrce msf undefinedhyperflexfileuploadrce show actions...

UNIX Gather Kerberos Tickets

Post Module to obtain all kerberos tickets on the targeted UNIX machine. Module Options msf use post/multi/gather/unixkerberostickets msf postunixkerberostickets show actions ...actions... msf postunixkerberostickets set ACTION msf postunixkerberostickets show options ...show and set options... m...

UNIX Gather Cached AD Hashes

Post Module to obtain all cached AD hashes on the targeted UNIX machine. These can be cracked with John the Ripper JtR. Module Options msf use post/multi/gather/unixcachedadhashes msf postunixcachedadhashes show actions ...actions... msf postunixcachedadhashes set ACTION msf postunixcachedadhashe...

Dell DBUtil_2_3.sys IOCTL memmove

The DBUtil23.sys driver distributed by Dell exposes an unprotected IOCTL interface that can be abused by an attacker read and write kernel-mode memory. Module Options msf use exploit/windows/local/cve/202121551dbutilmemmove msf undefined202121551dbutilmemmove show actions ...actions... msf...

Wordpress Plugin Backup Guard - Authenticated Remote Code Execution

This module allows an attacker with a privileged Wordpress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Backup Guard .php Module Options msf use exploit/multi/http/wp/pluginbackupguardrce msf undefinedpluginbackupguardrce show actions...

Redis Extractor

This module connects to a Redis instance and retrieves keys and data stored. Module Options msf use auxiliary/gather/redisextractor msf auxiliaryredisextractor show actions ...actions... msf auxiliaryredisextractor set ACTION msf auxiliaryredisextractor show options ...show and set options... msf...

SuiteCRM Log File Remote Code Execution

This module exploits an input validation error on the log file extension parameter. It does not properly validate upper/lower case characters. Once this occurs, the application log file will be treated as a php file. The log file can then be populated with php code by changing the username of a...

Git LFS Clone Command Exec

Git clients that support delay-capable clean / smudge filters and symbolic links on case-insensitive file systems are vulnerable to remote code execution while cloning a repository. Usage of clean / smudge filters through Git LFS and a case-insensitive file system changes the checkout order of...

Netgear R7000 backup.cgi Heap Overflow RCE

This module exploits a heap buffer overflow in the genie.cgi?backup.cgi page of Netgear R7000 routers running firmware version 1.0.11.116. Successful exploitation results in unauthenticated attackers gaining code execution as the root user. The exploit utilizes these privileges to enable the teln...

Pi-Hole Remove Commands Linux Priv Esc

Pi-Hole versions 3.0 - 5.3 allows for command line input to the removecustomcname, removecustomdns, and removestaticdhcp functions without properly validating the parameters before passing to sed. When executed as the www-data user, this allows for a privilege escalation to root since www-data is...

Apache Tapestry HMAC secret key leak

This exploit finds the HMAC secret key used in Java serialization by Apache Tapestry. This key is located in the file AppModule.class by default and looks like the standard representation of UUID in hex digits hd : 6hd-4hd-4hd-4hd-12hd If the HMAC key has been changed to look differently, this...

GitLab Unauthenticated Remote ExifTool Command Injection

This module exploits an unauthenticated file upload and command injection vulnerability in GitLab Community Edition CE and Enterprise Edition EE. The patched versions are 13.10.3, 13.9.6, and 13.8.8. Exploitation will result in command execution as the git user. Module Options msf use...

Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE

This module exploits an issue in the V8 engine on x86x64 builds of Google Chrome before 89.0.4389.128/90.0.4430.72 when handling XOR operations in JIT'd JavaScript code. Successful exploitation allows an attacker to execute arbitrary code within the context of the V8 process. As the V8 process is...

Cockpit CMS NoSQLi to RCE

This module exploits two NoSQLi vulnerabilities to retrieve the user list, and password reset tokens from the system. Next, the USER is targetted to reset their password. Then a command injection vulnerability is used to execute the payload. While it is possible to upload a payload and execute it...

2021 Ubuntu Overlayfs LPE

This module exploits a vulnerability in Ubuntu's implementation of overlayfs. The vulnerability is the result of failing to verify the ability of a user to set the attributes in a running executable. Specifically, when Overlayfs sends the set attributes data to the underlying file system via...

Haserl Arbitrary File Reader

This module exploits haserl prior to 0.9.36 to read arbitrary files. The most widely accepted exploitation vector is reading /etc/shadow, which will reveal root's hash for cracking. Module Options msf use post/linux/gather/haserlread msf posthaserlread show actions ...actions... msf posthaserlrea...

Diagnostics Agent in Solution Manager, stores unencrypted credentials for Solution Manager server

This module retrieves the secstore.properties file on a SMDAgent. This file contains the credentials used by the SMDAgent to connect to the SAP Solution Manager server. Module Options msf use post/multi/sap/smdagentgetproperties msf postsmdagentgetproperties show actions ...actions... msf...

Cisco Small Business RV Series Authentication Bypass and Command Injection

This module exploits an authentication bypass CVE-2021-1472 and command injection CVE-2021-1473 in the Cisco Small Business RV series of VPN/routers. The device does not adequately verify the credentials in the HTTP Authorization field when requests are made to the /upload endpoint. Then the...

Microsoft Exchange ProxyShell RCE

This module exploits a vulnerability on Microsoft Exchange Server that allows an attacker to bypass the authentication CVE-2021-31207, impersonate an arbitrary user CVE-2021-34523 and write an arbitrary file CVE-2021-34473 to achieve the RCE Remote Code Execution. By taking advantage of this...

VMware vRealize Operations (vROps) Manager SSRF RCE

This module exploits a pre-auth SSRF CVE-2021-21975 and post-auth file write CVE-2021-21983 in VMware vRealize Operations Manager to leak admin creds and write/execute a JSP payload. CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and CVE-2021-21983 affects the...

GravCMS Remote Command Execution

This module exploits arbitrary config write/update vulnerability to achieve remote code execution. Unauthenticated users can execute a terminal command under the context of the web server user. Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify...

Windows Gather Exchange Server Mailboxes

This module will gather information from an on-premise Exchange Server running on the target machine. Two actions are supported: LIST default action: List basic information about all Exchange servers and mailboxes hosted on the target. EXPORT: Export and download a chosen mailbox in the form of a...

Nagios XI Scanner

The module detects the version of Nagios XI applications and suggests matching exploit modules based on the version number. Since Nagios XI applications only reveal the version to authenticated users, valid credentials for a Nagios XI account are required. Alternatively, it is possible to provide...

macOS Gatekeeper check bypass

This module exploits two CVEs that bypass Gatekeeper. For CVE-2021-30657, this module serves an OSX app as a zip that contains no Info.plist, which bypasses gatekeeper in macOS use exploit/osx/browser/osx/gatekeeperbypass msf undefinedgatekeeperbypass show actions ...actions... msf...

Apache OFBiz SOAP Java Deserialization

This module exploits a Java deserialization vulnerability in Apache OFBiz's unauthenticated SOAP endpoint /webtools/control/SOAPService for versions prior to 17.12.06. Module Options msf use exploit/linux/http/apache/ofbizdeserializationsoap msf undefinedofbizdeserializationsoap show actions...

Win32k ConsoleControl Offset Confusion

A vulnerability exists within win32k that can be leveraged by an attacker to escalate privileges to those of NT AUTHORITY\SYSTEM. The flaw exists in how the WndExtra field of a window can be manipulated into being treated as an offset despite being populated by an attacker-controlled value. This...

rConfig Vendors Auth File Upload RCE

This module allows an attacker with a privileged rConfig account to start a reverse shell due to an arbitrary file upload vulnerability in /lib/crud/vendors.crud.php. Then, the uploaded payload can be triggered by a call to images/vendor/.php Module Options msf use...

F5 iControl REST Unauthenticated SSRF Token Generation RCE

This module exploits a pre-auth SSRF in the F5 iControl REST API's /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that can be used to execute root commands on an affected BIG-IP or BIG-IQ device. This vulnerability is known as CVE-2021-22986. CVE-2021-22986 affects the following...

VMware View Planner Unauthenticated Log File Upload RCE

This module exploits an unauthenticated log file upload within the loguploadwsgi.py file of VMWare View Planner 4.6 prior to 4.6 Security Patch 1. Successful exploitation will result in RCE as the apache user inside the appacheServer Docker container. Module Options msf use...

Microsoft Exchange ProxyLogon Collector

This module exploit a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin CVE-2021-26855. By taking advantage of this vulnerability, it is possible to dump all mailboxes emails, attachments, contacts, .... This vulnerabili...

Microsoft Exchange ProxyLogon RCE

This module exploit a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication, impersonating as the admin CVE-2021-26855 and write arbitrary file CVE-2021-27065 to get the RCE Remote Code Execution. By taking advantage of this vulnerability, you can execute...

Microsoft Exchange ProxyLogon Scanner

This module scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as the admin CVE-2021-26855. By chaining this bug with another post-auth arbitrary-file-write vulnerability to get code execution CVE-2021-27065. As a result, a...