Riverbed SteelCentral NetProfiler/NetExpress Remote Code Execution

This module exploits three separate vulnerabilities found in the Riverbed SteelCentral NetProfiler/NetExpress virtual appliances to obtain remote command execution as the root user. A SQL injection in the login form can be exploited to add a malicious user into the application's database. An...

Register Service

Register service if used with psexec for example This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasm' class MetasploitModule 'Register Service', 'Version' = '$Revision: 14774 $', 'Description' = 'Register...

SugarCRM REST Unserialize PHP Code Execution

This module exploits a PHP Object Injection vulnerability in SugarCRM CE use exploit/unix/webapp/sugarcrm/restunserializeexec msf undefinedrestunserializeexec show actions ...actions... msf undefinedrestunserializeexec set ACTION msf undefinedrestunserializeexec show options ...show and set...

JSON Swagger CodeGen Parameter Injector

This module generates an Open API Specification 2.0 Swagger compliant json document that includes payload insertion points in parameters. In order for the payload to be executed, an attacker must convince someone to generate code from a specially modified swagger.json file within a vulnerable...

phpMyAdmin Authenticated Remote Code Execution

phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the pregreplace aka eval modifier, which might allow remote attackers to execute arbitrary PHP code via a crafted string, as demonstrated by the table...

Service Persistence

This module will create a service on the box, and mark it for auto-restart. We need enough access to write service files and potentially restart services Targets: System V: CentOS = 9, = 9.10, = 7, = 15 Ubuntu = 15.04 Note: System V won't restart the service if it dies, only an init change reboot...

Cron Persistence

This module will create a cron or crontab entry to execute a payload. The module includes the ability to automatically clean up those entries to prevent multiple executions. syslog will get a copy of the cron entry. This module requires Metasploit: https://metasploit.com/download Current source:...

SSH Key Persistence

This module will add an SSH key to a specified user or all, to allow remote login via SSH at any time. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'sshkey' class MetasploitModule 'SSH Key Persistence',...

NetBIOS Response Brute Force Spoof (Direct)

This module continuously spams NetBIOS responses to a target for given hostname, causing the target to cache a malicious address for this name. On high-speed local networks, the PPSRATE value should be increased to speed up this attack. As an example, a value of around 30,000 is almost 100%...

NetBIOS Response "BadTunnel" Brute Force Spoof (NAT Tunnel)

This module listens for a NetBIOS name request and then continuously spams NetBIOS responses to a target for given hostname, causing the target to cache a malicious address for this name. On high-speed networks, the PPSRATE value should be increased to speed up this attack. As an example, a value...

Regsvr32.exe (.sct) Command Delivery Server

This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on a target system. The major advantage of this technique is that you can execute a static command on the target system and dynamically and remotely change the command that will actually run by...

Windows Gather Microsoft Office Trusted Locations

This module will enumerate the Microsoft Office trusted locations on the target host. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Microsoft Office Trusted Locations',...

Linux ARM Big Endian Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 118 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions def...

SMB Share Enumeration

This module determines what shares are provided by the SMB service and which ones are readable/writable. It also collects additional information such as share types, directories, files, time stamps, etc. By default, a RubySMB netshareenumall request is done in order to retrieve share information,...

ClamAV Remote Command Transmitter

In certain configurations, ClamAV will bind to all addresses and listen for commands. This module sends properly-formatted commands to the ClamAV daemon if it is in such a configuration. Module Options msf use auxiliary/scanner/misc/clamav/control msf undefinedcontrol show actions ...actions... m...

Jenkins Server Broadcast Enumeration

This module sends out a udp broadcast packet querying for any Jenkins servers on the local network. Be advised that while this module does not identify the port on which Jenkins is running, the default port for Jenkins is 8080. This module requires Metasploit: https://metasploit.com/download...

Apache Shiro v1.2.4 Cookie RememberME Deserial RCE

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Shiro v1.2.4. Note that other versions of Apache Shiro may also be exploitable if the encryption key used by Shiro to encrypt rememberMe cookies is known. The gadget chain used for Java...

Tiki-Wiki CMS Calendar Command Execution

Tiki-Wiki CMS's calendar module contains a remote code execution vulnerability within the viewmode GET parameter. The calendar module is NOT enabled by default. If enabled, the default permissions are set to NOT allow anonymous users to access. Vulnerable versions: use...

Linux Kernel 4.6.3 Netfilter Privilege Escalation

This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 not 16.04.1 with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. iptables.ko ubuntu, iptableraw fedora has to be loaded...

Poison Ivy 2.1.x C2 Buffer Overflow

This module exploits a stack buffer overflow in the Poison Ivy 2.1.x C&C server. The exploit does not need to know the password chosen for the bot/server communication. Module Options msf use exploit/windows/misc/poisonivy/21xbof msf undefined21xbof show actions ...actions... msf undefined21xbof...

Canon IR-Adv Password Extractor

This module will extract the passwords from address books on various Canon IR-Adv mfp devices. Tested models: iR-ADV C2030, iR-ADV 4045, iR-ADV C5030, iR-ADV C5235, iR-ADV C5240, iR-ADV 6055, iR-ADV C7065 This module requires Metasploit: https://metasploit.com/download Current source:...

Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 except 2.3.20.2 and 2.3.24.2. Remote Code Execution can be performed when using REST Plugin with ! operator when Dynamic Method Invocation is enabled. Module Options msf use...

ActiveMQ web shell upload

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request. Module Options msf use exploit/multi/http/apache/activemquploadjsp msf undefinedactivemquploadjsp show actions...

WordPress WP Mobile Detector 3.5 Shell Upload

WP Mobile Detector Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /wp-content/plugins/wp-mobile-detector/resize.php script does contains a remote file include for files not cached by the system already. By uploading a...

WinRM Login Utility

This module attempts to authenticate to a WinRM service. It currently works only if the remote end allows NegotiateNTLM authentication. Kerberos is not currently supported. Please note: in order to use this module without SSL, the 'AllowUnencrypted' winrm option must be set. Otherwise adjust the...

Ubiquiti airOS Arbitrary File Upload

This module exploits a pre-auth file upload to install a new root user to /etc/passwd and an SSH key to /etc/dropbear/authorizedkeys. FYI, /etc/passwd,dropbear/authorizedkeys will be overwritten. /etc/persistent/rc.poststart will be overwritten if PERSISTETC is true. This method is used by the "m...

Magento 2.0.6 Unserialize Remote Code Execution

This module exploits a PHP object injection vulnerability in Magento 2.0.6 or prior. Module Options msf use exploit/multi/http/magento/unserialize msf undefinedunserialize show actions ...actions... msf undefinedunserialize set ACTION msf undefinedunserialize show options ...show and set options...

Generate TCP/UDP Outbound Traffic On Multiple Ports

This module generates TCP or UDP traffic across a sequence of ports, and is useful for finding firewall holes and egress filtering. It only generates traffic on the port range you specify. It is up to you to run a responder or packet capture tool on a remote endpoint to determine which ports are...

Internet Explorer 11 VBScript Engine Memory Corruption

This module exploits the memory corruption vulnerability CVE-2016-0189 present in the VBScript engine of Internet Explorer 11. Module Options msf use exploit/windows/browser/ms16/051vbscript msf undefined051vbscript show actions ...actions... msf undefined051vbscript set ACTION msf...

WordPress Ninja Forms Unauthenticated File Upload

Versions 2.9.36 to 2.9.42 of the Ninja Forms plugin contain an unauthenticated file upload vulnerability, allowing guests to upload arbitrary PHP code that can be executed in the context of the web server...

WordPress Ninja Forms Unauthenticated File Upload

Versions 2.9.36 to 2.9.42 of the Ninja Forms plugin contain an unauthenticated file upload vulnerability, allowing guests to upload arbitrary PHP code that can be executed in the context of the web server. Module Options msf use exploit/multi/http/wp/ninjaformsunauthenticatedfileupload msf...

Linux BPF doubleput UAF Privilege Escalation

Linux kernel 4.4 use exploit/linux/local/bpf/privesc msf undefinedprivesc show actions ...actions... msf undefinedprivesc set ACTION msf undefinedprivesc show options ...show and set options... msf undefinedprivesc run This module requires Metasploit: https://metasploit.com/download Current sourc...

IPFire proxy.cgi RCE

IPFire, a free linux based open source firewall distribution, version use exploit/linux/http/ipfire/proxyexec msf undefinedproxyexec show actions ...actions... msf undefinedproxyexec set ACTION msf undefinedproxyexec show options ...show and set options... msf undefinedproxyexec run This module...

ImageMagick Delegate Arbitrary Command Execution

This module exploits a shell command injection in the way "delegates" commands for converting files are processed in ImageMagick versions use exploit/unix/fileformat/imagemagick/delegate msf undefineddelegate show actions ...actions... msf undefineddelegate set ACTION msf undefineddelegate show...

Allwinner 3.4 Legacy Kernel Local Privilege Escalation

This module attempts to exploit a debug backdoor privilege escalation in Allwinner SoC based devices. Vulnerable Allwinner SoC chips: H3, A83T or H8 which rely on Kernel 3.4. Vulnerable OS: all OS images available for Orange Pis, any for FriendlyARM's NanoPi M1, SinoVoip's M2+ and M3, Cuebietech'...

Apache Struts Dynamic Method Invocation Remote Code Execution

This module exploits a remote command execution vulnerability in Apache Struts version between 2.3.20 and 2.3.28 except 2.3.20.2 and 2.3.24.2. Remote Code Execution can be performed via method: prefix when Dynamic Method Invocation is enabled. Module Options msf use...

Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion

This module exploits a type confusion on Adobe Flash Player, which was originally found being successfully exploited in the wild. This module has been tested successfully on: macOS Sierra 10.12.3, Safari and Adobe Flash Player 21.0.0.182, Firefox and Adobe Flash Player 21.0.0.182. Module Options...

Windows Gather EMET Protected Paths

This module will enumerate the EMET protected paths on the target host. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather EMET Protected Paths', 'Description' = %q This module will...

Regsvr32.exe (.sct) Application Whitelisting Bypass Server

This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts an .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This...

pfSense authenticated graph status RCE

pfSense, a free BSD based open source firewall distribution, version use exploit/unix/http/pfsense/graphinjectionexec msf undefinedgraphinjectionexec show actions ...actions... msf undefinedgraphinjectionexec set ACTION msf undefinedgraphinjectionexec show options ...show and set options... msf...

HP Data Protector Encrypted Communication Remote Command Execution

This module exploits a well known remote code execution exploit after establishing encrypted control communications with a Data Protector agent. This allows exploitation of Data Protector agents that have been configured to only use encrypted control communications. This exploit works by executin...

Linux DoS Xen 4.2.0 2012-5525

This module causes a hypervisor crash in Xen 4.2.0 when invoked from a paravirtualized VM, including from dom0. Successfully tested on Debian 7 3.2.0-4-amd64 with Xen 4.2.0. This module requires Metasploit: https://metasploit.com/download Current source:...

op5 v7.1.9 Configuration Command Execution

op5 an open source network monitoring software. The configuration page in version 7.1.9 and below allows the ability to test a system command, which can be abused to run arbitrary code as an unpriv user. Module Options msf use exploit/linux/http/op5/configexec msf undefinedconfigexec show actions...

ExaGrid Known SSH Key and Default Password

ExaGrid ships a public/private key pair on their backup appliances to allow passwordless authentication to other ExaGrid appliances. Since the private key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. Additionally, this module will attempt to use the...

Apache Continuum Arbitrary Command Execution

This module exploits a command injection in Apache Continuum use exploit/linux/http/apache/continuumcmdexec msf undefinedcontinuumcmdexec show actions ...actions... msf undefinedcontinuumcmdexec set ACTION msf undefinedcontinuumcmdexec show options ...show and set options... msf...

Apache CouchDB Arbitrary Command Execution

CouchDB administrative users can configure the database server via HTTPS. Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitra...

Z/OS (MVS) Command Shell, Reverse TCP

Provide JCL which creates a reverse shell This implementation does not include ebcdic character translation, so a client with translation capabilities is required. MSF handles this automatically. This module requires Metasploit: https://metasploit.com/download Current source:...

Novell ServiceDesk Authenticated File Upload

This module exploits an authenticated arbitrary file upload via directory traversal to execute code on the target. It has been tested on versions 6.5 and 7.1.0, in Windows and Linux installations of Novell ServiceDesk, as well as the Virtual Appliance provided by Novell. Module Options msf use...

Generic JCL Test for Mainframe Exploits

Provide JCL which can be used to submit a job to JES2 on z/OS which will exit and return 0. This can be used as a template for other JCL based payloads This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This is a prototy...

HID discoveryd command_blink_on Unauthenticated RCE

This module exploits an unauthenticated remote command execution vulnerability in the discoveryd service exposed by HID VertX and Edge door controllers. This module was tested successfully on a HID Edge model EH400 with firmware version 2.3.1.603 Build 04/23/2012. Module Options msf use...