Github Enterprise Default Session Secret And Deserialization Vulnerability

This module exploits two security issues in Github Enterprise, version 2.8.0 - 2.8.6. The first is that the session management uses a hard-coded secret value, which can be abused to sign a serialized malicious Ruby object. The second problem is due to the use of unsafe deserialization, which allo...

Sync Breeze Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of Sync Breeze Enterprise v9.4.28, v10.0.28, and v10.1.16, caused by improper bounds checking of the request in HTTP GET and POST requests sent to the built-in web server. This module has been tested successfull...

VX Search Enterprise GET Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in the web interface of VX Search Enterprise v9.5.12, caused by improper bounds checking of the request path in HTTP GET requests sent to the built-in web server. This module has been tested successfully on Windows 7 SP1 x86. Module...

MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption

This module is a port of the Equation Group ETERNALBLUE exploit, part of the FuzzBunch toolkit released by Shadow Brokers. There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a DWORD is subtracted in...

MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution

This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where primitive. This will then be used to overwrite the connection session information with as an Administrator session. From there, the normal psexec command execution is done. Exploits a type confusion betwee...

MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution

This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where primitive. This will then be used to overwrite the connection session information with as an Administrator session. From there, the normal psexec payload code execution is done. Exploits a type confusion...

Samsung SRN-1670D Web Viewer Version 1.0.0.193 Arbitrary File Read and Upload

This module exploits an unrestricted file upload vulnerability in Web Viewer 1.0.0.193 on Samsung SRN-1670D devices. The networksslupload.php file allows remote authenticated attackers to upload and execute arbitrary PHP code via a filename with a .php extension, which is then accessed via a dire...

dnaLIMS Admin Module Command Execution

This module utilizes an administrative module which allows for command execution. This page is completely unprotected from any authentication when given a POST request. Module Options msf use exploit/linux/http/dnalims/adminexec msf undefinedadminexec show actions ...actions... msf...

DnaLIMS Directory Traversal

This module exploits a directory traversal vulnerability found in dnaLIMS. Due to the way the viewAppletFsa.cgi script handles the 'secID' parameter, it is possible to read a file outside the www directory. Module Options msf use auxiliary/scanner/http/dnalims/fileretrieve msf undefinedfileretrie...

MMS Client

This module sends an MMS message to multiple phones of the same carrier. You can use it to send a malicious attachment to phones. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MMS Client',...

Sends Beacons to Scan for Active ZigBee Networks

Post Module to send beacon signals to the broadcast address while channel hopping This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sends Beacons to Scan for Active ZigBee Networks', 'Description...

Easy File Sharing FTP Server 3.6 Directory Traversal

This module exploits a directory traversal vulnerability found in Easy File Sharing FTP Server Version 3.6 and Earlier. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command that includes file system traversal strings such as '../' Module...

Apache Struts Jakarta Multipart Parser OGNL Injection

This module exploits a remote code execution vulnerability in Apache Struts version 2.3.5 - 2.3.31, and 2.5 - 2.5.10. Remote Code Execution can be performed via http Content-Type header. Native payloads will be converted to executables and dropped in the server's temp dir. If this fails, try a cm...

FTPShell client 6.70 (Enterprise edition) Stack Buffer Overflow

This module exploits a buffer overflow in the FTPShell client 6.70 Enterprise edition allowing remote code execution. Module Options msf use exploit/windows/ftp/ftpshell/clibof msf undefinedclibof show actions ...actions... msf undefinedclibof set ACTION msf undefinedclibof show options ...show a...

DC/OS Marathon UI Docker Exploit

Utilizing the DCOS Cluster's Marathon UI, an attacker can create a docker container with the '/' path mounted with read/write permissions on the host server that is running the docker container. As the docker container executes command as uid 0 it is honored by the host operating system allowing...

SMS Client

This module sends a text message to multiple phones of the same carrier. You can use it to send a malicious link to phones. Please note that you do not use this module to send a media file attachment. In order to send a media file, please use auxiliary/client/mms/sendmms instead. This module...

Cambium ePMP 1000 'ping' Password Hash Extractor (up to v2.5)

This module exploits an OS Command Injection vulnerability in Cambium ePMP 1000 Authors Karn Ganeshen This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cambium ePMP 1000 'ping' Password Hash...

SysGauge 1.5.18 SMTP Validation Buffer Overflow

This module will setup an SMTP server expecting a connection from SysGauge 1.5.18 via its SMTP server validation. The module sends a malicious response along in the 220 service ready response and exploits the client, resulting in an unprivileged shell. Module Options msf use...

Logsign Remote Command Injection

This module exploits a command injection vulnerability in Logsign. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the root user. Logsign has a publicly accessible endpoint. That endpoint takes a user input and then use it during operating system command...

Netgear DGN2200 dnslookup.cgi Command Injection

This module exploits a command injection vulnerablity in NETGEAR DGN2200v1/v2/v3/v4 routers by sending a specially crafted post request with valid login details. Module Options msf use exploit/linux/http/netgear/dnslookupcmdexec msf undefineddnslookupcmdexec show actions ...actions... msf...

Gather Tomcat Credentials

This module will attempt to collect credentials from Tomcat services running on the machine. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Gather Tomcat Credentials', 'Description' = %q This...

Jboss Credential Collector

This module can be used to extract the Jboss admin passwords for version 4,5 and 6. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'Jboss Credential Collector', 'Description'...

Architecture Migrate

This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a new process with the correct architecture and migrates into that process. This module requires Metasploit: https://metasploit.com/download Current source:...

NTDS Grabber

This module uses a powershell script to obtain a copy of the ntds,dit SAM and SYSTEM files on a domain controller. It compresses all these files in a cabinet file called All.cab. This module requires Metasploit: https://metasploit.com/download Current source:...

Windows Gather DynaZIP Saved Password Extraction

This module extracts clear text credentials from dynazip.log. The log file contains passwords used to encrypt compressed zip files in Microsoft Plus! 98 and Windows Me. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Kodi 17.0 Local File Inclusion Vulnerability

This module exploits a directory traversal flaw found in Kodi before 17.1. Module Options msf use auxiliary/scanner/http/kodi/traversal msf undefinedtraversal show actions ...actions... msf undefinedtraversal set ACTION msf undefinedtraversal show options ...show and set options... msf...

Carlo Gavazzi Energy Meters - Login Brute Force, Extract Info and Dump Plant Database

This module scans for Carlo Gavazzi Energy Meters login portals, performs a login brute force attack, enumerates device firmware version, and attempt to extract the SMTP configuration. A valid, admin privileged user is required to extract the SMTP password. In some older firmware versions, the SM...

Microsoft SQL Server Clr Stored Procedure Payload Execution

This module executes an arbitrary native payload on a Microsoft SQL server by loading a custom SQL CLR Assembly into the target SQL installation, and calling it directly with a base64-encoded payload. The module requires working credentials in order to connect directly to the MSSQL Server. This...

Apache OpenOffice Text Document Malicious Macro Execution

This module generates an Apache OpenOffice Text Document with a malicious macro in it. To exploit successfully, the targeted user must adjust the security level in Macro Security to either Medium or Low. If set to Medium, a prompt is presented to the user to enable or disable the macro. If set to...

Android Meterpreter Shell, Reverse HTTPS Inline

Connect back to attacker and spawn a Meterpreter shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include Msf::Payload::TransportConfig include Msf::Payload::Single...

NETGEAR Administrator Password Disclosure

This module will collect the password for the admin user. The exploit will not complete if password recovery is set on the router. The password is received by passing the token generated from unauth.cgi to passwordrecovered.cgi. This exploit works on many different NETGEAR products. The full list...

Piwik Superuser Plugin Upload

This module will generate a plugin, pack the payload into it and upload it to a server running Piwik. Superuser Credentials are required to run this module. This module does not work against Piwik 1 as there is no option to upload custom plugins. Piwik disabled custom plugin uploads in version...

Postfixadmin Protected Alias Deletion Vulnerability

Postfixadmin installations between 2.91 and 3.0.1 do not check if an admin is allowed to delete protected aliases. This vulnerability can be used to redirect protected aliases to an other mail address. Eg. rewrite the postmaster@domain alias. Module Options msf use...

WordPress REST API Content Injection

This module exploits a content injection vulnerability in WordPress versions 4.7 and 4.7.1 via type juggling in the REST API. Module Options msf use auxiliary/scanner/http/wordpress/contentinjection msf undefinedcontentinjection show actions ...actions... msf undefinedcontentinjection set ACTION...

Cambium ePMP 1000 Dump Device Config

This module dumps Cambium ePMP 1000 device configuration file. An ePMP 1000 box has four 4 login accounts - admin/admin, installer/installer, home/home, and readonly/readonly. This module requires any one of the following login credentials - admin / installer / home - to dump device configuration...

Binom3 Web Management Login Scanner, Config and Password File Dump

This module scans for Binom3 Multifunctional Revenue Energy Meter and Power Quality Analyzer management login portals, and attempts to identify valid credentials. There are four 4 default accounts - 'root'/'root', 'admin'/'1', 'alg'/'1', 'user'/'1'. In addition to device config, 'root' user can...

QNAP NAS/NVR Administrator Hash Disclosure

This module exploits combined heap and stack buffer overflows for QNAP NAS and NVR devices to dump the admin root shadow hash from memory via an overwrite of libcargv0 in the HTTP-header-bound glibc backtrace. A binary search is performed to find the correct offset for the BOFs. Since the server...

Disk Savvy Enterprise v10.4.18

This module exploits a stack-based buffer overflow vulnerability in Disk Savvy Enterprise v10.4.18, caused by improper bounds checking of the request sent to the built-in server. This module has been tested successfully on Windows 7 SP1 x86. Module Options msf use exploit/windows/misc/disk/savvya...

AlienVault OSSIM/USM Remote Code Execution

This module exploits object injection, authentication bypass and ip spoofing vulnerabilities all together. Unauthenticated users can execute arbitrary commands under the context of the root user. By abusing authentication bypass issue on gauge.php lead adversaries to exploit object injection...

mDNS Spoofer

This module will listen for mDNS multicast requests on 5353/udp for A and AAAA record queries, and respond with a spoofed IP address assuming the request matches our regex. This module requires Metasploit: https://metasploit.com/download Current source:...

Advantech WebAccess Login

This module will attempt to authenticate to Advantech WebAccess. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/advantechwebaccess' require...

Haraka SMTP Command Injection

The Haraka SMTP server comes with a plugin for processing attachments. Versions before 2.8.9 can be vulnerable to command injection Module Options msf use exploit/linux/smtp/haraka msf undefinedharaka show actions ...actions... msf undefinedharaka set ACTION msf undefinedharaka show options ...sh...

Oracle Weblogic Server Deserialization RCE - RMI UnicastRef

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object sun.rmi.server.UnicastRef to the interface to execute code on vulnerable hosts. Module Options msf use exploit/multi/misc/weblogic/deserializeunicastref msf...

Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE

This module exploits a stack Buffer Overflow in the GCore server GCoreServer.exe. The vulnerable webserver is running on Port 13003 and Port 13004, does not require authentication and affects all versions from 2003 till July 2016 Version 1.4.YYYYY. Module Options msf use...

Cisco WebEx Chrome Extension RCE (CVE-2017-3823)

This module exploits a vulnerability present in the Cisco WebEx Chrome Extension version 1.0.1 which allows an attacker to execute arbitrary commands on a system. Module Options msf use exploit/windows/browser/cisco/webexext msf undefinedwebexext show actions ...actions... msf undefinedwebexext s...

Advantech WebAccess 8.1 Post Authentication Credential Collector

This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials. Although authentication is required, any level of user permission can exploit this vulnerability. Note that 8.2 is not suitable for this. Module Options msf use auxiliary/gather/advantech/webaccesscred...

Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution

This module exploits a command injection vulnerability in the Trend Micro IMSVA product. An authenticated user can execute a terminal command under the context of the web server user which is root. Besides, default installation of IMSVA comes with a default administrator credentials. saveCert.ims...

Cisco Firepower Management Console 6.0 Login

This module attempts to authenticate to a Cisco Firepower Management console via HTTPS. The credentials are also used for SSH, which could allow remote code execution. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

Hardware Bridge Server

This module sets up a web server to bridge communications between Metasploit and physically attached hardware. Currently this module supports: automotive This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework TODO: SSL...

Sample Module to Flood Temp Gauge on 2006 Malibu

Simple sample temp flood for the 2006 Malibu This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sample Module to Flood Temp Gauge on 2006 Malibu', 'Description' = %q Simple sample temp flood for t...