Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation

This module writes to the sudoers file without root access by exploiting rsh and malloc log files. Makes sudo require no password, giving access to su even if root is disabled. Works on OS X 10.9.5 to 10.10.5 patched on 10.11. Module Options msf use exploit/osx/local/rsh/libmalloc msf...

Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write

This module exploits a vulnerability that exists due to a lack of input validation when creating a user. Messages for a given user are stored in a directory partially defined by the username. By creating a user with a directory traversal payload as the username, commands can be written to a given...

MSSQL Login Utility

This module simply queries the MSSQL instance for a specific user/pass default is sa with blank. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

PCMan FTP Server 2.0.7 Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability found in PCMan FTP Server 2.0.7. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command that includes file system traversal strings such as '..//' Module Options msf use...

BisonWare BisonFTP Server 3.5 Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability found in BisonWare BisonFTP server version 3.5. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command including file system traversal strings such as '..//.' Module Options msf use...

Vtiger CRM - Authenticated Logo Upload RCE

Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This module was tested against vTiger CRM v6.3.0. Module Options m...

Kaseya VSA uploader.aspx Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions between 7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary directory leading to arbitrary code execution with IUSR privileges. This module has been tested with Kaseya v7.0.0.17...

Kaseya VSA Master Administrator Account Creation

This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new Master Administrator account. Normally this page is only accessible via the localhost interface, but the application does nothing to prevent this apart from attempting to force a redirect. This module has been...

Konica Minolta FTP Utility 1.00 Directory Traversal Information Disclosure

This module exploits a directory traversal vulnerability found in Konica Minolta FTP Utility 1.0. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command that includes file system traversal strings such as '..//' Module Options msf use...

Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability

This module exploits an unsafe intent URI scheme and directory traversal found in Android Mercury Browser version 3.2.3. The intent allows the attacker to invoke a private wifi manager activity, which starts a web server for Mercury on port 8888. The webserver also suffers a directory traversal...

ManageEngine OpManager Remote Code Execution

This module exploits a default credential vulnerability in ManageEngine OpManager, where a default hidden account "IntegrationUser" with administrator privileges exists. The account has a default password of "plugin" which cannot be reset through the user interface. By log-in and abusing the...

Portmapper Amplification Scanner

This module can be used to discover Portmapper services which can be used in an amplification DDoS attack against a third party. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Portmapper...

Simple Backdoor Shell Remote Code Execution

This module exploits unauthenticated simple web backdoor shells by leveraging the common backdoor shell's vulnerable parameter to execute commands. The SecLists project of Daniel Miessler and Jason Haddix has a lot of samples for these kind of backdoor shells which is categorized under Payloads...

MS15-100 Microsoft Windows Media Center MCL Vulnerability

This module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the .mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. Module Options msf use exploit/windows/fileformat/ms15/100mclexe msf undefined100mclexe show actio...

F5 iControl iCall::Script Root Command Execution

This module exploits an authenticated privilege escalation vulnerability in the iControl API on the F5 BIG-IP LTM and likely other F5 devices. This requires valid credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, 11.5.x use...

Jenkins-CI Unauthenticated Script-Console Scanner

This module scans for unauthenticated Jenkins-CI script consoles and executes the specified command. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'cgi' class MetasploitModule 'Jenkins-CI Unauthenticated...

WordPress NextGEN Gallery Directory Read Vulnerability

This module exploits an authenticated directory traversal vulnerability in WordPress Plugin "NextGEN Gallery" version 2.1.7, allowing to read arbitrary directories with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source:...

Nibbleblog File Upload Vulnerability

Nibbleblog contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 4.0.3. Module Options msf use exploit/multi/http/nibbleblog/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf...

UPnP IGD SOAP Port Mapping Utility

Manage port mappings on UPnP IGD-capable device using the AddPortMapping and DeletePortMapping SOAP requests This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'nokogiri' class MetasploitModule 'UPnP IGD SOAP Por...

Boxoft WAV to MP3 Converter v1.1 Buffer Overflow

This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter versions 1.0 and 1.1. By constructing a specially crafted WAV file and attempting to convert it to an MP3 file in the application, a buffer is overwritten, which allows for running shellcode. Module Options msf use...

BusyBox Download and Execute

This module will be applied on a session connected to a BusyBox shell. It will use wget to download and execute a file from the device running BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox Enumerate Connections

This module will be applied on a session connected to a BusyBox shell. It will enumerate the connections established with the router or device executing BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox SMB Sharing

This module will be applied on a session connected to a BusyBox shell. It will modify the SMB configuration of the device executing BusyBox to share the root directory of the device. This module requires Metasploit: https://metasploit.com/download Current source:...

BusyBox DNS Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to set the DNS server on the device executing BusyBox so it will be sent by the DHCP server to network hosts. This module requires Metasploit: https://metasploit.com/download Current source:...

BusyBox Jailbreak

This module will send a set of commands to an open session that is connected to a BusyBox limited shell i.e. a router limited shell. It will try different known tricks to jailbreak the limited shell and get a full BusyBox shell. This module requires Metasploit: https://metasploit.com/download...

BusyBox Enumerate Host Names

This module will be applied on a session connected to a BusyBox shell. It will enumerate host names related to the device executing BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

BusyBox DMZ Configuration

This module will be applied on a session connected to a BusyBox shell. It allows to manage traffic forwarding to a target host through the BusyBox device. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

BusyBox Ping Network Enumeration

This module will be applied on a session connected to a BusyBox shell. It will ping a range of IP addresses from the router or device executing BusyBox. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Windows Gather Active Directory Groups

This module will enumerate AD groups on the specified domain. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Gather Active Directory Groups', 'Description' = %q This module will...

phpFileManager 0.9.8 Remote Code Execution

This module exploits a remote code execution vulnerability in phpFileManager 0.9.8 which is a filesystem management tool on a single file. Module Options msf use exploit/multi/http/phpfilemanager/rce msf undefinedrce show actions ...actions... msf undefinedrce set ACTION msf undefinedrce show...

WordPress Responsive Thumbnail Slider Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in Responsive Thumbnail Slider Plugin v1.0 for WordPress post authentication. Module Options msf use exploit/multi/http/wp/responsivethumbnailsliderupload msf undefinedresponsivethumbnailsliderupload show actions ...actions... msf...

Android Meterpreter Browsable Launcher

This module allows you to open an android meterpreter via a browser. An Android meterpreter must be installed as an application beforehand on the target device in order to use this. For best results, you can consider using the auxiliary/client/sms/sendtext to trick your target into opening the...

PHP Meterpreter, Reverse TCP Inline

Connect back to attacker and spawn a Meterpreter server PHP This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 34928 include Msf::Payload::Single include Msf::Payload::Php::ReverseTcp...

MVPower DVR Shell Unauthenticated Command Execution

This module exploits an unauthenticated remote command execution vulnerability in MVPower digital video recorders. The 'shell' file on the web interface executes arbitrary operating system commands in the query string. This module was tested successfully on a MVPower model TV-7104HE with firmware...

Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow

This module exploits an SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which leads to an SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerabilit...

Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)

This module will bypass Windows UAC by utilizing the missing .manifest on the script host cscript/wscript.exe binaries. Module Options msf use exploit/windows/local/bypassuac/vbs msf undefinedvbs show actions ...actions... msf undefinedvbs set ACTION msf undefinedvbs show options ...show and set...

ManageEngine ServiceDesk Plus Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. The vulnerability exists in the FileUploader servlet which accepts unauthenticated file uploads. This module has been tested successfully on versions v9 b9000 - b9102 in Windows and Linux. The MSP versions do not...

Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload

This module exploits a directory traversal vulnerability CVE-2015-1830 in Apache ActiveMQ 5.x before 5.11.2 for Windows. The module tries to upload a JSP payload to the /admin directory via the traversal path /fileserver/..\admin\ using an HTTP PUT request with the default ActiveMQ credentials...

WordPress Symposium Plugin SQL Injection

This module exploits a SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress, which allows remote attackers to extract credentials via the size parameter to getalbumitem.php. Module Options msf use auxiliary/admin/http/wp/symposiumsqlinjection msf...

CMS Bolt File Upload Vulnerability

Bolt CMS contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 2.2.4. Module Options msf use exploit/multi/http/bolt/fileupload msf undefinedfileupload show actions ...actions... msf undefinedfileupload set ACTION msf...

Mac OS X "tpwn" Privilege Escalation

This module exploits a null pointer dereference in XNU to escalate privileges to root. Tested on 10.10.4 and 10.10.5. Module Options msf use exploit/osx/local/tpwn msf undefinedtpwn show actions ...actions... msf undefinedtpwn set ACTION msf undefinedtpwn show options ...show and set options... m...

Firefox PDF.js Browser File Theft

This module abuses an XSS vulnerability in versions prior to Firefox 39.0.3, Firefox ESR 38.1.1, and Firefox OS 2.2 that allows arbitrary files to be stolen. The vulnerability occurs in the PDF.js component, which uses Javascript to render a PDF inside a frame with privileges to read local files...

Android Stagefright MP4 tx3g Integer Overflow

This module exploits an integer overflow vulnerability in the Stagefright Library libstagefright.so. The vulnerability occurs when parsing specially crafted MP4 files. While a wide variety of remote attack vectors exist, this particular exploit is designed to work within an HTML5 compliant browse...

Multi Recon Local Exploit Suggester

This module suggests local meterpreter exploits that can be used. The exploits are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in meterpreter. It's important to note that not all local exploits will be fired. Exploits are...

Path Traversal in Oracle GlassFish Server Open Source Edition

This module exploits an unauthenticated directory traversal vulnerability which exists in administration console of Oracle GlassFish Server 4.1, which is listening by default on port 4848/TCP. Module Options msf use auxiliary/scanner/http/glassfish/traversal msf undefinedtraversal show actions...

PCMAN FTP Server Buffer Overflow - PUT Command

This module exploits a buffer overflow vulnerability found in the PUT command of the PCMAN FTP v2.0.7 Server. This requires authentication but by default anonymous credentials are enabled. Module Options msf use exploit/windows/ftp/pcman/put msf undefinedput show actions ...actions... msf...

WordPress Mobile Pack Information Disclosure Vulnerability

This module exploits an information disclosure vulnerability in WordPress Plugin "WP Mobile Pack" version 2.1.2, allowing to read files with privileges information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework clas...

WordPress Subscribe Comments File Read Vulnerability

This module exploits an authenticated directory traversal vulnerability in WordPress Plugin "Subscribe to Comments" version 2.1.2, allowing to read arbitrary files with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source:...

AppLocker Execution Prevention Bypass

This module will generate a .NET service executable on the target and utilize InstallUtil to run the payload bypassing the AppLocker protection. Currently only the InstallUtil method is provided, but future methods can be added easily. Module Options msf use exploit/windows/local/applocker/bypass...

Hak5 WiFi Pineapple Preconfiguration Command Injection

This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 use exploit/linux/http/pineapple/bypasscmdinject msf undefinedbypasscmdinject show actions ...actions... msf undefinedbypasscmdinject set ACTION msf undefinedbypasscmdinject show options ...show and set...