Panda Security PSEvents Privilege Escalation

PSEvents.exe within several Panda Security products runs hourly with SYSTEM privileges. When run, it checks a user writable folder for certain DLL files, and if any are found they are automatically run. Vulnerable Products: Panda Global Protection 2016 'Panda Security PSEvents Privilege...

Windows Capcom.sys Kernel Execution Exploit (x64 only)

This module abuses the Capcom.sys kernel driver's function that allows for an arbitrary function to be executed in the kernel from user land. This function purposely disables SMEP prior to invoking a function given by the caller. This has been tested on Windows 7, 8.1, 10 x64 and Windows 11 x64...

Android Stagefright MP4 tx3g Integer Overflow

This module exploits an integer overflow vulnerability in the Stagefright Library libstagefright.so. The vulnerability occurs when parsing specially crafted MP4 files. While a wide variety of remote attack vectors exist, this particular exploit is designed to work within an HTML5 compliant browse...

Allwinner 3.4 Legacy Kernel Local Privilege Escalation

This module attempts to exploit a debug backdoor privilege escalation in Allwinner SoC based devices. Vulnerable Allwinner SoC chips: H3, A83T or H8 which rely on Kernel 3.4. Vulnerable OS: all OS images available for Orange Pis, any for FriendlyARM's NanoPi M1, SinoVoip's M2+ and M3, Cuebietech'...

Cisco ASA Authentication Bypass (EXTRABACON)

This module patches the authentication functions of a Cisco ASA to allow uncredentialed logins. Uses improved shellcode for payload...

Android Meterpreter Shell, Reverse TCP Inline

Connect back to the attacker and spawn a Meterpreter shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::TransportConfig include Msf::Payload::Sing...

Android Meterpreter Shell, Reverse HTTP Inline

Connect back to attacker and spawn a Meterpreter shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::TransportConfig include Msf::Payload::Single...

Kaltura Remote PHP Code Execution

This module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura has a module named keditorservices that takes user input and then uses it as an unserialized...

Metasploit Web UI Static secret_key_base Value

This module exploits the Web UI for Metasploit Community, Express and Pro where one of a certain set of Weekly Releases have been applied. These Weekly Releases introduced a static secretkeybase value. Knowledge of the static secretkeybase value allows for deserialization of a crafted Ruby Object...

ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability found in ColoradoFTP server version 'ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure', 'Description' = %q This module exploits a directory traversal vulnerability found in ColoradoFTP server version 'win', 'Author'...

Siemens Profinet Scanner

This module will use Layer2 packets, known as Profinet Discovery packets, to detect all Siemens and sometimes other devices on a network. It is perfectly SCADA-safe, as there will only be ONE single packet sent out. Devices will respond with their IP configuration and hostnames. Created by XiaK...

Metasploit Web UI Diagnostic Console Command Execution

This module exploits the "diagnostic console" feature in the Metasploit Web UI to obtain a reverse shell. The diagnostic console is able to be enabled or disabled by an administrator on Metasploit Pro and by an authenticated user on Metasploit Express and Metasploit Community. When enabled, the...

Octopus Deploy Login Utility

This module simply attempts to login to an Octopus Deploy server using a specific username and password. It has been confirmed to work on version 3.4.4 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 'Hak5 WiFi Pineapple Preconfiguration Command Injection', 'Description' = %q This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 'catatonicprime', 'License' =...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 'Hak5 WiFi Pineapple Preconfiguration Command Injection', 'Description' = %q This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 = pineapple 2.4. We use a combination of default...

SugarCRM REST Unserialize PHP Code Execution

This module exploits a PHP Object Injection vulnerability in SugarCRM CE 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This module exploits a PHP Object Injection vulnerability in SugarCRM CE 'EgiX', 'License' = MSFLICENSE, 'References' = 'URL', 'http...

Better

Better NOP generator This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework MixedNop ---------- This class implements a mixed NOP generator for MIPS big endian class MetasploitModule 'Better', 'Alias' = 'mipsbebetter',...

Zabbix toggle_ids SQL Injection

This module will exploit a SQL injection in Zabbix 3.0.3 and likely prior in order to save the current usernames and password hashes from the database to a JSON file. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

NetBSD mail.local Privilege Escalation

This module attempts to exploit a race condition in mail.local with SUID bit set on: NetBSD 7.0 - 7.0.1 verified on 7.0.1 NetBSD 6.1 - 6.1.5 NetBSD 6.0 - 6.0.6 Successful exploitation relies on a crontab job with root privilege, which may take up to 10min to execute. This module requires...

Phoenix Exploit Kit Remote Code Execution

This module exploits a Remote Code Execution in the web panel of Phoenix Exploit Kit via geoip.php. The Phoenix Exploit Kit is a popular commercial crimeware tool that probes the browser of the visitor for the presence of outdated and insecure versions of browser plugins like Java and Adobe Flash...

Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability

It was found that Internet Explorer allows the disclosure of local file names. This issue exists due to the fact that Internet Explorer behaves different for file:// URLs pointing to existing and non-existent files. When used in combination with HTML5 sandbox iframes it is possible to use this...

Office OLE Multiple DLL Side Loading Vulnerabilities

Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an...

Trend Micro Smart Protection Server Exec Remote Code Injection

This module exploits a vulnerability found in TrendMicro Smart Protection Server where untrusted inputs are fed to ServWebExec system command, leading to command injection. Please note: authentication is required to exploit this vulnerability. This module requires Metasploit:...

Samsung Security Manager 1.4 ActiveMQ Broker Service PUT Method Remote Code Execution

This is an exploit against Samsung Security Manager that bypasses the patch in ZDI-15-156 & ZDI-16-481 by exploiting the vulnerability against the client-side. This exploit has been tested successfully using IE, FireFox and Chrome by abusing a GET request XSS to bypass CORS and reach the vulnerab...

DLL Side Loading Vulnerability in VMware Host Guest Client Redirector

A DLL side loading vulnerability was found in the VMware Host Guest Client Redirector, a component of VMware Tools. This issue can be exploited by luring a victim into opening a document from the attacker's share. An attacker can exploit this issue to execute arbitrary code with the privileges of...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset

The NVRmini 2 Network Video Recorded and the ReadyNAS Surveillance application are vulnerable to an administrator password reset on the exposed web management interface. Note that this only works for unauthenticated attackers in earlier versions of the Nuuo firmware before v1.7.6, otherwise you...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Unauthenticated Remote Code Execution

The NVRmini 2 Network Video Recorder and the ReadyNAS Surveillance application are vulnerable to an unauthenticated remote code execution on the exposed web administration interface. This results in code execution as root in the NVRmini and the 'admin' user in ReadyNAS. This exploit has been test...

NUUO NVRmini 2 / Crystal / NETGEAR ReadyNAS Surveillance Authenticated Remote Code Execution

The NVRmini 2 Network Video Recorder, Crystal NVR and the ReadyNAS Surveillance application are vulnerable to an authenticated remote code execution on the exposed web administration interface. An administrative account is needed to exploit this vulnerability. This results in code execution as ro...

Multi Manage File Compressor

This module zips a file or a directory. On Linux, it uses the zip command. On Windows, it will try to use remote target's 7Zip if found. If not, it falls back to its Windows Scripting Host. This module requires Metasploit: https://metasploit.com/download Current source:...

Internet Explorer 11 VBScript Engine Memory Corruption

This module exploits the memory corruption vulnerability CVE-2016-0189 present in the VBScript engine of Internet Explorer 11. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Internet Explorer ...

SMB Delivery

This module serves payloads via an SMB server and provides commands to retrieve and execute the generated payloads. Currently supports DLLs and Powershell. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Windows Gather Avira Password Extraction

This module extracts the weakly hashed password which is used to protect a Avira Antivirus 'Windows Gather Avira Password Extraction', 'Description' = %q This module extracts the weakly hashed password which is used to protect a Avira Antivirus MSFLICENSE, 'Author' = 'Robert Kugler / robertchrk',...

Drupal CODER Module Remote Command Execution

This module exploits a Remote Command Execution vulnerability in the Drupal CODER Module. Unauthenticated users can execute arbitrary commands under the context of the web server user. The CODER module doesn't sufficiently validate user inputs in a script file that has the PHP extension. A...

Drupal RESTWS Module Remote PHP Code Execution

This module exploits a Remote PHP Code Execution vulnerability in the Drupal RESTWS Module. Unauthenticated users can execute arbitrary code under the context of the web server user. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this...

Windows Gather MDaemonEmailServer Credential Cracking

Finds and cracks the stored passwords of MDaemon Email Server This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'base64' class MetasploitModule 'Windows Gather MDaemonEmailServer Credential Cracking',...

Microsoft Windows Authenticated User Code Execution

This module uses a valid administrator username and password or password hash to execute an arbitrary payload. This module is similar to the "psexec" utility provided by SysInternals. This module is now able to clean up after itself. The service created by this tool uses a randomly chosen name an...

OpenNMS Java Object Unserialization Remote Code Execution

This module exploits a vulnerability in the OpenNMS Java object which allows an unauthenticated attacker to run arbitrary code against the system. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Tiki Wiki Unauthenticated File Upload Vulnerability

This module exploits a file upload vulnerability in Tiki Wiki 'Tiki Wiki Unauthenticated File Upload Vulnerability', 'Description' = %q This module exploits a file upload vulnerability in Tiki Wiki = 15.1 which could be abused to allow unauthenticated users to execute arbitrary code under the...

MS16-016 mrxdav.sys WebDav Local Privilege Escalation

This module exploits the vulnerability in mrxdav.sys described by MS16-016. The module will spawn a process on the target system and elevate its privileges to NT AUTHORITY\SYSTEM before executing the specified payload within the context of the elevated process. This module requires Metasploit:...

WebNMS Framework Server Credential Disclosure

This module abuses two vulnerabilities in WebNMS Framework Server 5.2 to extract all user credentials. The first vulnerability is an unauthenticated file download in the FetchFile servlet, which is used to download the file containing the user credentials. The second vulnerability is that the...

WebNMS Framework Server Arbitrary Text File Download

This module abuses a vulnerability in WebNMS Framework Server 5.2 that allows an unauthenticated user to download files off the file system by using a directory traversal attack on the FetchFile servlet. Note that only text files can be downloaded properly, as any binary file will get mangled by...

WebNMS Framework Server Arbitrary File Upload

This module abuses a vulnerability in WebNMS Framework Server 5.2 that allows an unauthenticated user to upload text files by using a directory traversal attack on the FileUploadServlet servlet. A JSP file can be uploaded that then drops and executes a malicious payload, achieving code execution...

Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution

This module exploits three separate vulnerabilities found in the Riverbed SteelCentral NetProfiler/NetExpress virtual appliances to obtain remote command execution as the root user. A SQL injection in the login form can be exploited to add a malicious user into the application's database. An...

Zutto Dekiru

Inspired by shikataganai using fxsave64 to work under x64 systems. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' require 'rex/nop/opty2' class MetasploitModule 'Zutto Dekiru', 'Version' = '$Revision...

Docker Daemon Privilege Escalation

This module obtains root privileges from any host account with access to the Docker daemon. Usually this includes accounts in the docker group. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

Ruby on Rails ActionPack Inline ERB Code Execution

This module exploits a remote code execution vulnerability in the inline request processor of the Ruby on Rails ActionPack component. This vulnerability allows an attacker to process ERB to the inline JSON processor, which is then rendered, permitting full RCE within the runtime, without logging ...

Nagios XI Chained Remote Code Execution

This module exploits an SQL injection, auth bypass, file upload, command injection, and privilege escalation in Nagios XI 'Nagios XI Chained Remote Code Execution', 'Description' = %q This module exploits an SQL injection, auth bypass, file upload, command injection, and privilege escalation in...

JSON Swagger CodeGen Parameter Injector

This module generates an Open API Specification 2.0 Swagger compliant json document that includes payload insertion points in parameters. In order for the payload to be executed, an attacker must convince someone to generate code from a specially modified swagger.json file within a vulnerable...

Register Service

Register service if used with psexec for example This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Register Service', 'Version' = '$Revision: 14774 $', 'Description' = 'Register...

Service Persistence

This module will create a service on the box, and mark it for auto-restart. We need enough access to write service files and potentially restart services Targets: System V: CentOS = 9, = 9.10, = 7, = 15 Ubuntu = 15.04 Note: System V won't restart the service if it dies, only an init change reboot...