D-Link Central WiFiManager SQL injection

This module exploits a SQLi vulnerability found in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6. The vulnerability is an exposed API endpoint that allows the execution of SQL queries without authentication, using this vulnerability, it's possible to retrieve usernames and password...

Docker-Credential-Wincred.exe Privilege Escalation

This exploit leverages a vulnerability in docker desktop community editions prior to 2.1.0.1 where an attacker can write a payload to a lower-privileged area to be executed automatically by the docker user at login. Module Options msf use exploit/windows/local/docker/credentialwincred msf...

Linux Polkit pkexec helper PTRACE_TRACEME local root exploit

This module exploits an issue in ptracelink in kernel/ptrace.c before Linux kernel 5.1.17. This issue can be exploited from a Linux desktop terminal, but not over an SSH session, as it requires execution from within the context of a user with an active Polkit agent. In the Linux kernel before...

Hostname-based Context Keyed Payload Encoder

Context-Keyed Payload Encoder based on hostname and x64 XOR encoder. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Hostname-based Context Keyed Payload Encoder', 'Description' = 'Context-Keye...

Xymon Daemon Gather Information

This module retrieves information from a Xymon daemon service formerly Hobbit, based on Big Brother, including server configuration information, a list of monitored hosts, and associated client log for each host. This module also retrieves usernames and password hashes from the xymonpasswd config...

Cisco Data Center Network Manager Unauthenticated Remote Code Execution

DCNM exposes a file upload servlet FileUploadServlet at /fm/fileUpload. An authenticated user can abuse this servlet to upload a WAR to the Apache Tomcat webapps directory and achieve remote code execution as root. This module exploits two other vulnerabilities, CVE-2019-1619 for authentication...

Cisco Data Center Network Manager Unauthenticated File Download

DCNM exposes a servlet to download files on /fm/downloadServlet. An authenticated user can abuse this servlet to download arbitrary files as root by specifying the full path of the file. This module was tested on the DCNM Linux virtual appliance 10.42, 11.01 and 11.11, and should work on a few...

Unix Command Shell, Reverse TCP SSH

Connect back and create a command shell via SSH This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/handler/reversessh' module MetasploitModule CachedSize = :dynamic include Msf::Payload::Single include...

Amazon Web Services S3 instance enumeration

Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all S3 buckets associated with the account This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'aws-sdk-s3' clas...

Amazon Web Services IAM credential enumeration

Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all IAM credentials associated with the account This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'aws-sdk-iam...

Amazon Web Services EC2 instance enumeration

Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all EC2 instances associated with the account This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'aws-sdk-ec2'...

Extract zip from Modbus communication

This module is able to extract a zip file sent through Modbus from a pcap. Tested with Schneider TM221CE16R This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Extract zip from Modbus communication...

Brocade Gather Device General Information

This module collects Brocade device information and configuration. This module has been tested against an icx6430 running 08.0.20T311...

FusionPBX Operator Panel exec.php Command Execution

This module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operatorpanelview permissions, or administrator permissions, to execute arbitrary commands as the web server user by sending ...

Serv-U FTP Server prepareinstallation Privilege Escalation

This module attempts to gain root privileges on systems running Serv-U FTP Server versions prior to 15.1.7. The Serv-U executable is setuid root, and uses ARGV0 in a call to system, without validation, when invoked with the -prepareinstallation flag, resulting in command execution with root...

Exim 4.87 - 4.91 Local Privilege Escalation

This module exploits a flaw in Exim versions 4.87 to 4.91 inclusive. Improper validation of recipient address in delivermessage function in /src/deliver.c may lead to command execution with root privileges CVE-2019-10149. Module Options msf use exploit/linux/local/exim4/delivermessageprivesc msf...

Windows x64 Command Shell, Bind TCP Stager (RC4 Stage Encryption, Metasm)

Spawn a piped command shell Windows x64 staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 616 include Msf::Payload::Stager...

Windows x64 VNC Server (Reflective Injection), Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject a VNC Dll via a reflective loader Windows x64 staged. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 616 include...

Windows Meterpreter (Reflective Injection x64), Bind TCP Stager (RC4 Stage Encryption, Metasm)

Inject the meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Connect back to the attacker -- coding: binary -- This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Supra Smart Cloud TV Remote File Inclusion

This module exploits an unauthenticated remote file inclusion which exists in Supra Smart Cloud TV. The media control for the device doesn't have any session management or authentication. Leveraging this, an attacker on the local network can send a crafted request to broadcast a fake video. Modul...

Ahsay Backup v7.x-v8.1.1.50 (authenticated) file upload

This module exploits an authenticated insecure file upload and code execution flaw in Ahsay Backup v7.x - v8.1.1.50. To successfully execute the upload, credentials are needed; default Ahsay Backup trial accounts are enabled so an account can be created. It can be exploited in Windows and Linux...

Password Cracker: Databases

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from the mssqlhashdump, mysqlhashdump, postgreshashdump, or oraclehashdump modules. Passwords that have been successfully cracked are then saved as proper credentials. Due to the complexity of some of t...

Password Cracker: AIX

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from passwd files on AIX systems. These utilize DES hashing. DES is format 1500 in Hashcat. This module requires Metasploit: https://metasploit.com/download Current source:...

Password Cracker: Windows

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from Windows systems. LANMAN is format 3000 in hashcat. NTLM is format 1000 in hashcat. MSCASH is format 1100 in hashcat. MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 ...

Password Cracker: Webapps

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from various web applications. Atlassian uses PBKDF2-HMAC-SHA1 which is 12001 in hashcat. PHPass uses phpass which is 400 in hashcat. Mediawiki is MD5 based and is 3711 in hashcat. Apache Superset, some...

Password Cracker: Linux

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from unshadowed passwd files from Unix/Linux systems. The module will only crack MD5, BSDi and DES implementations by default. However, it can also crack Blowfish and SHA256/512, but it is much slower...

Password Cracker: OSX

This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from OSX systems. The module will only crack xsha from OSX 10.4-10.6, xsha512 from 10.7, and PBKDF2 from OSX 10.8+. XSHA is 122 in hashcat. XSHA512 is 1722 in hashcat. PBKDF2 PBKDF2-HMAC-SHA512 is 7100 ...

Atlassian Crowd pdkinstall Unauthenticated Plugin Upload RCE

This module can be used to upload a plugin on Atlassian Cloud via the pdkinstall development plugin as an unauthenticated attacker. The payload is uploaded as a JAR archive containing a servlet using a POST request to /crowd/admin/uploadplugin.action. The check command will check that the...

Unix Command Shell, Reverse UDP (/dev/udp)

Creates an interactive shell via bash's builtin /dev/udp. This will not work on circa 2009 and older Debian-based Linux distributions including Ubuntu because they compile bash without the /dev/udp feature. This module requires Metasploit: https://metasploit.com/download Current source:...

ATutor 2.2.4 - Directory Traversal / Remote Code Execution,

This module exploits an arbitrary file upload vulnerability together with a directory traversal flaw in ATutor versions 2.2.4, 2.2.2 and 2.2.1 in order to execute arbitrary commands. It first creates a zip archive containing a malicious PHP file. The zip archive takes advantage of a directory...

OpenEMR 5.0.1 Patch 6 SQLi Dump

This module exploits a SQLi vulnerability found in OpenEMR version 5.0.1 Patch 6 and lower. The vulnerability allows the contents of the entire database with exception of log and task tables to be extracted. This module saves each table as a .csv file in your loot directory and has been tested wi...

Webmin Package Updates Remote Command Execution

This module exploits an arbitrary command execution vulnerability in Webmin 1.910 and lower versions. Any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges. Module Options msf use exploit/linux/http/webmin/packageuprce msf undefinedpackageuprce sh...

IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution

This module exploits untrusted serialized data processed by the WAS DMGR Server and Cells. NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset. Module Options msf use exploit/windows/ibm/ibm/wasdmgrjavadeserializationrce msf...

Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability

This module exploits a vulnerability found in Cisco Prime Infrastructure. The issue is that the TarArchive Java class the HA Health Monitor component uses does not check for any directory traversals while unpacking a Tar file, which can be abused by a remote user to leverage the UploadServlet cla...

DLINK DWL-2600 Authenticated Remote Command Injection

Some DLINK Access Points are vulnerable to an authenticated OS command injection. Default credentials for the web interface are admin/admin. Module Options msf use exploit/linux/http/dlink/dwl2600commandinjection msf undefineddwl2600commandinjection show actions ...actions... msf...

CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check

This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MST120 channel outside of its normal slot and sending non-DoS packets which respond differently on patched and vulnerable hosts. It can optionally trigger the DoS vulnerability. Module Options msf use...

CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free

The RDP termdd.sys driver improperly handles binds to internal-only channel MST120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve...

Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE

This module exploits a php object instantiation vulnerability that can lead to RCE in Shopware. An authenticated backend user could exploit the vulnerability. The vulnerability exists in the createInstanceFromNamedArguments function, where the code insufficiently performs whitelist check which ca...

Barco WePresent file_transfer.cgi Command Injection

This module exploits an unauthenticated remote command injection vulnerability found in Barco WePresent and related OEM'ed products. The vulnerability is triggered via an HTTP POST request to the filetransfer.cgi endpoint. Module Options msf use exploit/linux/http/wepresent/cmdinjection msf...

Applocker Evasion - .NET Framework Installation Utility

This module will assist you in evading Microsoft Windows Applocker and Software Restriction Policies. This technique utilises the Microsoft signed binary InstallUtil.exe to execute user supplied code. This module requires Metasploit: https://metasploit.com/download Current source:...

Moodle Admin Shell Upload

This module will generate a plugin which can receive a malicious payload request and upload it to a server running Moodle provided valid admin credentials are used. Then the payload is sent for execution, and the plugin uninstalled. You must have an admin account to exploit this vulnerability...

GetSimpleCMS Unauthenticated RCE

This module exploits a vulnerability found in GetSimpleCMS, which allows unauthenticated attackers to perform Remote Code Execution. An arbitrary file upload PHPcode for example vulnerability can be triggered by an authenticated user, however authentication can be bypassed by leaking the cms API...

GTP Echo Scanner

This module sends UDP GTP GTP-U echo requests to the target RHOSTS and reports on which ones respond, thus identifying General Packet Radio Service GPRS servers. This module does not support scanning with SCTP. This module requires Metasploit: https://metasploit.com/download Current source:...

Pulse Secure VPN Arbitrary File Disclosure

This module exploits a pre-auth directory traversal in the Pulse Secure VPN server to dump an arbitrary file. Dumped files are stored in loot. If the "Automatic" action is set, plaintext and hashed credentials, as well as session IDs, will be dumped. Valid sessions can be hijacked by setting the...

WP Database Backup RCE

There exists a command injection vulnerability in the Wordpress plugin wp-database-backup for versions use exploit/multi/http/wp/dbbackuprce msf undefineddbbackuprce show actions ...actions... msf undefineddbbackuprce set ACTION msf undefineddbbackuprce show options ...show and set options... msf...

Pulse Secure VPN Arbitrary Command Execution

This module exploits a post-auth command injection in the Pulse Secure VPN server to execute commands as root. The env1 command is used to bypass application whitelisting and run arbitrary commands. Please see related module auxiliary/gather/pulsesecurefiledisclosure for a pre-auth file read that...

Oracle Weblogic Server Deserialization RCE - AsyncResponseService

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a malicious SOAP request to the interface WLS AsyncResponseService to execute code on the vulnerable host. Module Options msf use exploit/multi/misc/weblogic/deserializeasyncresponseservice msf...

Spring Cloud Config Server Directory Traversal

This module exploits an unauthenticated directory traversal vulnerability which exists in Spring Cloud Config versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6. Spring Cloud Config listens by default on port 8888. Module Options msf use...

SmarterTools SmarterMail less than build 6985 - .NET Deserialization Remote Code Execution

This module exploits a vulnerability in the SmarterTools SmarterMail software for version numbers use exploit/windows/http/smartermail/rce msf undefinedrce show actions...

Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal

This module exploits a vulnerability in Oracle Application Testing Suite OATS. In the Load Testing interface, a remote user can abuse the custom report template selector, and cause the DownloadServlet class to read any file on the server as SYSTEM. Since the Oracle application contains multiple...