Simple Backdoor Shell Remote Code Execution

This module exploits unauthenticated simple web backdoor shells by leveraging the common backdoor shell's vulnerable parameter to execute commands. The SecLists project of Daniel Miessler and Jason Haddix has a lot of samples for these kind of backdoor shells which is categorized under Payloads...

MS15-100 Microsoft Windows Media Center MCL Vulnerability

This module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the .mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. Module Options msf use exploit/windows/fileformat/ms15/100mclexe msf undefined100mclexe show actio...

F5 iControl iCall::Script Root Command Execution

This module exploits an authenticated privilege escalation vulnerability in the iControl API on the F5 BIG-IP LTM and likely other F5 devices. This requires valid credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, 11.5.x use...

Jenkins-CI Unauthenticated Script-Console Scanner

This module scans for unauthenticated Jenkins-CI script consoles and executes the specified command. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'cgi' class MetasploitModule 'Jenkins-CI Unauthenticated...

WordPress NextGEN Gallery Directory Read Vulnerability

This module exploits an authenticated directory traversal vulnerability in WordPress Plugin "NextGEN Gallery" version 2.1.7, allowing to read arbitrary directories with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source:...

Nibbleblog File Upload Vulnerability

Nibbleblog contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 4.0.3. Module Options msf use exploit/multi/http/nibbleblog/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf...

UPnP IGD SOAP Port Mapping Utility

Manage port mappings on UPnP IGD-capable device using the AddPortMapping and DeletePortMapping SOAP requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'UPnP IGD SOAP Por...

Boxoft WAV to MP3 Converter v1.1 Buffer Overflow

This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter versions 1.0 and 1.1. By constructing a specially crafted WAV file and attempting to convert it to an MP3 file in the application, a buffer is overwritten, which allows for running shellcode. Module Options msf use...

BusyBox SMB Sharing

This module will be applied on a session connected to a BusyBox shell. It will modify the SMB configuration of the device executing BusyBox to share the root directory of the device. This module requires Metasploit: https://metasploit.com/download Current source:...

BusyBox DNS Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to set the DNS server on the device executing BusyBox so it will be sent by the DHCP server to network hosts. This module requires Metasploit: https://metasploit.com/download Current source:...

BusyBox Enumerate Connections

This module will be applied on a session connected to a BusyBox shell. It will enumerate the connections established with the router or device executing BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox Download and Execute

This module will be applied on a session connected to a BusyBox shell. It will use wget to download and execute a file from the device running BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox Jailbreak

This module will send a set of commands to an open session that is connected to a BusyBox limited shell i.e. a router limited shell. It will try different known tricks to jailbreak the limited shell and get a full BusyBox shell. This module requires Metasploit: https://metasploit.com/download...

BusyBox Enumerate Host Names

This module will be applied on a session connected to a BusyBox shell. It will enumerate host names related to the device executing BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

BusyBox DMZ Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to manage traffic forwarding to a target host through the BusyBox device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox Ping Network Enumeration

This module will be applied on a session connected to a BusyBox shell. It will ping a range of IP addresses from the router or device executing BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Windows Gather Active Directory Groups

This module will enumerate AD groups on the specified domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Active Directory Groups', 'Description' = %q This module will...

phpFileManager 0.9.8 Remote Code Execution

This module exploits a remote code execution vulnerability in phpFileManager 0.9.8 which is a filesystem management tool on a single file. Module Options msf use exploit/multi/http/phpfilemanager/rce msf undefinedrce show actions ...actions... msf undefinedrce set ACTION msf undefinedrce show...

WordPress Responsive Thumbnail Slider Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in Responsive Thumbnail Slider Plugin v1.0 for WordPress post authentication. Module Options msf use exploit/multi/http/wp/responsivethumbnailsliderupload msf undefinedresponsivethumbnailsliderupload show actions ...actions... msf...

Android Meterpreter Browsable Launcher

This module allows you to open an android meterpreter via a browser. An Android meterpreter must be installed as an application beforehand on the target device in order to use this. For best results, you can consider using the auxiliary/client/sms/sendtext to trick your target into opening the...

PHP Meterpreter, Reverse TCP Inline

Connect back to attacker and spawn a Meterpreter server PHP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 34928 include Msf::Payload::Single include Msf::Payload::Php::ReverseTcp...

Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow

This module exploits an SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which leads to an SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerabilit...

MVPower DVR Shell Unauthenticated Command Execution

This module exploits an unauthenticated remote command execution vulnerability in MVPower digital video recorders. The 'shell' file on the web interface executes arbitrary operating system commands in the query string. This module was tested successfully on a MVPower model TV-7104HE with firmware...

Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)

This module will bypass Windows UAC by utilizing the missing .manifest on the script host cscript/wscript.exe binaries. Module Options msf use exploit/windows/local/bypassuac/vbs msf undefinedvbs show actions ...actions... msf undefinedvbs set ACTION msf undefinedvbs show options ...show and set...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The MSP versions do not...

Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload

This module exploits a directory traversal vulnerability CVE-2015-1830 in Apache ActiveMQ 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default ActiveMQ credentials...

WordPress Symposium Plugin SQL Injection

This module exploits a SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress, which allows remote attackers to extract credentials via the size parameter to getalbumitem.php. Module Options msf use auxiliary/admin/http/wp/symposiumsqlinjection msf...

CMS Bolt File Upload Vulnerability

Bolt CMS contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 2.2.4. Module Options msf use exploit/multi/http/bolt/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf...

Mac OS X "tpwn" Privilege Escalation

This module exploits a null pointer dereference in XNU to escalate privileges to root. Tested on 10.10.4 and 10.10.5. Module Options msf use exploit/osx/local/tpwn msf undefinedtpwn show actions ...actions... msf undefinedtpwn set ACTION msf undefinedtpwn show options ...show and set options... m...

Firefox PDF.js Browser File Theft

This module abuses an XSS vulnerability in versions prior to Firefox 39.0.3, Firefox ESR 38.1.1, and Firefox OS 2.2 that allows arbitrary files to be stolen. The vulnerability occurs in the PDF.js component, which uses Javascript to render a PDF inside a frame with privileges to read local files...

Android Stagefright MP4 tx3g Integer Overflow

This module exploits an integer overflow vulnerability in the Stagefright Library libstagefright.so. The vulnerability occurs when parsing specially crafted MP4 files. While a wide variety of remote attack vectors exist, this particular exploit is designed to work within an HTML5 compliant browse...

Multi Recon Local Exploit Suggester

This module suggests local meterpreter exploits that can be used. The exploits are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter. It's important to note that not all local exploits will be fired. Exploits are...

Path Traversal in Oracle GlassFish Server Open Source Edition

This module exploits an unauthenticated directory traversal vulnerability which exists in administration console of Oracle GlassFish Server 4.1, which is listening by default on port 4848/TCP. Module Options msf use auxiliary/scanner/http/glassfish/traversal msf undefinedtraversal show actions...

PCMAN FTP Server Buffer Overflow - PUT Command

This module exploits a buffer overflow vulnerability found in the PUT command of the PCMAN FTP v2.0.7 Server. This requires authentication but by default anonymous credentials are enabled. Module Options msf use exploit/windows/ftp/pcman/put msf undefinedput show actions ...actions... msf...

WordPress Mobile Pack Information Disclosure Vulnerability

This module exploits an information disclosure vulnerability in WordPress Plugin "WP Mobile Pack" version 2.1.2, allowing to read files with privileges information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework clas...

WordPress Subscribe Comments File Read Vulnerability

This module exploits an authenticated directory traversal vulnerability in WordPress Plugin "Subscribe to Comments" version 2.1.2, allowing to read arbitrary files with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source:...

AppLocker Execution Prevention Bypass

This module will generate a .NET service executable on the target and utilize InstallUtil to run the payload bypassing the AppLocker protection. Currently only the InstallUtil method is provided, but future methods can be added easily. Module Options msf use exploit/windows/local/applocker/bypass...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 use exploit/linux/http/pineapple/bypasscmdinject msf undefinedbypasscmdinject show actions ...actions... msf undefinedbypasscmdinject set ACTION msf undefinedbypasscmdinject show options ...show and set...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 use exploit/linux/http/pineapple/preconfigcmdinject msf undefinedpreconfigcmdinject show actions ...actions... msf undefinedpreconfigcmdinject set ACTION msf undefinedpreconfigcmdinject show options ...show and...

Symantec Endpoint Protection Manager Authentication Bypass and Code Execution

This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. The vulnerabilities include an authentication bypass, a directory traversal and a privilege escalation to get privileged code execution...

Heroes of Might and Magic III .h3m Map file Buffer Overflow

This module embeds an exploit into an uncompressed map file .h3m for Heroes of Might and Magic III. Once the map is started in-game, a buffer overflow occurring when loading object sprite names leads to shellcode execution. Module Options msf use exploit/windows/fileformat/homm3/h3m msf...

SMB Group Policy Preference Saved Passwords Enumeration

This module enumerates files from target domain controllers and connects to them via SMB. It then looks for Group Policy Preference XML files containing local/domain user accounts and passwords and decrypts them using Microsoft's public AES key. This module has been tested successfully on a Win2k...

BIND TKEY Query Denial of Service

This module sends a malformed TKEY query, which exploits an error in handling TKEY queries on affected BIND9 'named' DNS servers. As a result, a vulnerable named server will exit with a REQUIRE assertion failure. This condition can be exploited in versions of BIND between BIND 9.1.0 through 9.8.x...

Moxa Device Credential Retrieval

The Moxa protocol listens on 4800/UDP and will respond to broadcast or direct traffic. The service is known to be used on Moxa devices in the NPort, OnCell, and MGate product lines. Many devices with firmware versions older than 2017 or late 2016 allow admin credentials and SNMP read and read/wri...

Libuser roothelper Privilege Escalation

This module attempts to gain root privileges on Red Hat based Linux systems, including RHEL, Fedora and CentOS, by exploiting a newline injection vulnerability in libuser and userhelper versions prior to 0.56.13-8 and version 0.60 before 0.60-7. This module makes use of the roothelper.c exploit...

Sticky Keys Persistence Module

This module makes it possible to apply the 'sticky keys' hack to a session with appropriate rights. The hack provides a means to get a SYSTEM shell using UI-level interaction at an RDP login screen or via a UAC confirmation dialog. The module modifies the Debug registry setting for certain...

Apple OS X DYLD_PRINT_TO_FILE Privilege Escalation

In Apple OS X 10.10.4 and prior, the DYLDPRINTTOFILE environment variable is used for redirecting logging data to a file instead of stderr. Due to a design error, this feature can be abused by a local attacker to write arbitrary files as root via restricted, SUID-root binaries. Module Options msf...

Windows Post Kill Antivirus and Hips

This module attempts to locate and terminate any processes that are identified as being Antivirus or Host-based IPS related. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Post Kill...

ManageEngine EventLog Analyzer Remote Code Execution

This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6 build 10060 and previous versions. Every authenticated user, including the default "guest" account can execute SQL queries directly on the underlying Postgres database server. The queries are executed as the...

MS15-078 Microsoft Windows Font Driver Buffer Overflow

This module exploits a pool based buffer overflow in the atmfd.dll driver when parsing a malformed font. The vulnerability was exploited by the hacking team and disclosed in the July data leak. This module has been tested successfully on vulnerable builds of Windows 8.1 x64. Module Options msf us...