BSD x64 Command Shell, Reverse TCP Inline

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 81 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD x64 Command Shell, Bind TCP Inline

Listen for a connection and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 88 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD x64 Command Shell, Reverse TCP Inline (IPv6)

Connect back to attacker and spawn a command shell over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 105 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD x64 Command Shell, Bind TCP Inline (IPv6)

Listen for a connection and spawn a command shell over IPv6 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 90 include Msf::Payload::Single include Msf::Payload::Bsd include...

Windows Gather Active Directory BitLocker Recovery

This module will enumerate BitLocker recovery passwords in the default AD directory. This module does require Domain Admin or other delegated privileges. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

VS Code Extension Persistence

This module installs a malicious VS Code extension into the target's VS Code extensions directory. The extension executes the payload each time VS Code is launched, providing persistent code execution. Supports VS Code, VS Code Insiders, VSCodium, VS Code Server, and Cursor. Tested against 1.120....

Legend Perl IRC Bot Remote Code Execution

This module exploits a remote command execution on the Legend Perl IRC Bot. This bot has been used as a payload in the Shellshock spam last October 2014. This particular bot has functionalities like NMAP scanning, TCP, HTTP, SQL, and UDP flooding, the ability to remove system logs, and ability to...

Windows Interactive Powershell Session, Reverse TCP

Listen for a connection and spawn an interactive powershell session This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include...

Windows Interactive Powershell Session, Bind TCP

Listen for a connection and spawn an interactive powershell session This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' Extends the Exec payload to run a powershell command module MetasploitModule...

InfluxDB Enum Utility

This module enumerates databases on InfluxDB using the REST API using the default authentication of root:root. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'InfluxDB Enum Utility',...

Windows Interactive Powershell Session, Bind TCP

Interacts with a powershell session on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include Msf::Payload::Sing...

Windows Interactive Powershell Session, Reverse TCP

Interacts with a powershell session on an established socket connection This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/powershell' module MetasploitModule CachedSize = :dynamic include Msf::Payload::Sing...

WordPress GI-Media Library Plugin Directory Traversal Vulnerability

This module exploits a directory traversal vulnerability in WordPress Plugin GI-Media Library version 2.2.2, allowing to read arbitrary files from the system with the web server privileges. This module has been tested successfully on GI-Media Library version 2.2.2 with WordPress 4.1.3 on Ubuntu...

Realtek SDK Miniigd UPnP SOAP Command Execution

Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested successfully on a Trendnet TEW-731BR...

ProFTPD 1.3.5 Mod_Copy Command Execution

This module exploits the SITE CPFR/CPTO modcopy commands in ProFTPD version 1.3.5. Any unauthenticated client can leverage these commands to copy files from any part of the filesystem to a chosen destination. The copy commands are executed with the rights of the ProFTPD service, which by default...

GoAutoDial 3.3 Authentication Bypass / Command Injection

This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command...

WordPress DukaPress Plugin File Read Vulnerability

This module exploits a directory traversal vulnerability in WordPress Plugin "DukaPress" version 'WordPress DukaPress Plugin File Read Vulnerability', 'Description' = %q This module exploits a directory traversal vulnerability in WordPress Plugin "DukaPress" version 'EDB', '35346', 'CVE',...

WordPress Mobile Edition File Read Vulnerability

This module exploits a directory traversal vulnerability in WordPress Plugin "WP Mobile Edition" version 2.2.7, allowing to read arbitrary files with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source:...

BSD x64 Shell Bind TCP

Bind an arbitrary command to an arbitrary port This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 136 include Msf::Payload::Single include Msf::Payload::Bsd include...

BSD x64 Shell Reverse TCP

Connect back to attacker and spawn a command shell This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 98 include Msf::Payload::Single include Msf::Payload::Bsd include...

MS15-034 HTTP Protocol Stack Request Handling Denial-of-Service

This module will check if scanned hosts are vulnerable to CVE-2015-1635 MS15-034, a vulnerability in the HTTP protocol stack HTTP.sys that could result in arbitrary code execution. This module will try to cause a denial-of-service. This module requires Metasploit: https://metasploit.com/download...

TeamCity Agent XML-RPC Command Execution

This module allows remote code execution on TeamCity Agents configured to use bidirectional communication via xml-rpc. In bidirectional mode the TeamCity server pushes build commands to the Build Agents over port TCP/9090 without requiring authentication. Up until version 10 this was the default...

ABRT raceabrt Privilege Escalation

This module attempts to gain root privileges on Linux systems with a vulnerable version of Automatic Bug Reporting Tool ABRT configured as the crash handler. A race condition allows local users to change ownership of arbitrary files CVE-2015-3315. This module uses a symlink attack on...

BSD x64 Execute Command

Execute an arbitrary command This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exec ---- Executes an arbitrary command. module MetasploitModule CachedSize = 31 include Msf::Payload::Single include Msf::Payload::Bsd def...

Wordpress N-Media Website Contact Form Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress N-Media Website Contact Form plugin, version 1.3.4. The vulnerability allows for arbitrary file upload and remote code execution. Module Options msf use exploit/unix/webapp/wp/nmediawebsitefileupload msf...

Lenovo System Update Privilege Escalation

The named pipe, \SUPipeServer, can be accessed by normal users to interact with the System update service. The service provides the possibility to execute arbitrary commands as SYSTEM if a valid security token is provided. This token can be generated by calling the GetSystemInfoData function in t...

Nessus RPC Interface Login Utility

This module will attempt to authenticate to a Nessus server RPC interface. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/nessus' require...

Apple OS X Rootpipe Privilege Escalation

This module exploits a hidden backdoor API in Apple's Admin framework on Mac OS X to escalate privileges to root, dubbed "Rootpipe." This module was tested on Yosemite 10.10.2 and should work on previous versions. The patch for this issue was not backported to older releases. Note: you must run...

ManageEngine Desktop Central Login Utility

This module will attempt to authenticate to a ManageEngine Desktop Central. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/manageenginedesktopcentral' require...

Arris / Motorola Surfboard SBG6580 Web Interface Takeover

The web interface for the Arris / Motorola Surfboard SBG6580 has several vulnerabilities that, when combined, allow an arbitrary website to take control of the modem, even if the user is not currently logged in. The attacker must successfully know, or guess, the target's internal gateway IP...

Archer C7 Directory Traversal Vulnerability

This module exploits a directory traversal vulnerability in the PATHINFO found at /login/ on TP-Link Archer C5, C7, and C9 routers of varying versions. Module Options msf use auxiliary/gather/tplink/archerc7traversal msf undefinedarcherc7traversal show actions ...actions... msf...

Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft

A vulnerability exists in versions of OSX, iOS, and Windows Safari released before April 8, 2015 that allows the non-HTTPOnly cookies of any domain to be stolen. Module Options msf use auxiliary/gather/apple/safariftpurlcookietheft msf undefinedsafariftpurlcookietheft show actions ...actions... m...

Embedthis GoAhead Embedded Web Server Directory Traversal

This module exploits a directory traversal vulnerability in the Embedthis GoAhead Web Server v3.4.1, allowing an attacker to read arbitrary files with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source:...

Novell ZENworks Configuration Management Arbitrary File Upload

This module exploits a file upload vulnerability in Novell ZENworks Configuration Management ZCM, which is part of the ZENworks Suite. The vulnerability exists in the UploadServlet which accepts unauthenticated file uploads and does not check the "uid" parameter for directory traversal characters...

Ceragon FibeAir IP-10 SSH Private Key Exposure

Ceragon ships a public/private key pair on FibeAir IP-10 devices that allows passwordless authentication to any other IP-10 device. Since the key is easily retrievable, an attacker can use it to gain unauthorized remote access as the "mateidu" user. Module Options msf use...

Firefox PDF.js Privileged Javascript Injection

This module gains remote code execution on Firefox 35-36 by abusing a privilege escalation bug in resource:// URIs. PDF.js is used to exploit the bug. This exploit requires the user to click anywhere on the page to trigger the vulnerability. Module Options msf use...

Airties login-cgi Buffer Overflow

This module exploits a remote buffer overflow vulnerability on several Airties routers. The vulnerability exists in the handling of HTTP queries to the login cgi with long redirect parameters. The vulnerability doesn't require authentication. This module has been tested successfully on the...

Apport / ABRT chroot Privilege Escalation

This module attempts to gain root privileges on Linux systems by invoking the default coredump handler inside a namespace "container". Apport versions 2.13 through 2.17.x before 2.17.1 on Ubuntu are vulnerable, due to a feature which allows forwarding reports to a container's Apport by changing t...

Gallery WD for Joomla! Unauthenticated SQL Injection Scanner

This module will scan for Joomla! instances vulnerable to an unauthenticated SQL injection within the Gallery WD for Joomla! extension version 1.2.5 and likely prior. Module Options msf use auxiliary/scanner/http/joomla/gallerywdsqliscanner msf undefinedgallerywdsqliscanner show actions...

Windows Gather Local SQL Server Hash Dump

This module extracts the usernames and password hashes from an MSSQL server and stores them as loot. It uses the same technique in mssqllocalauthbypass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

SSL Labs API Client

This module is a simple client for the SSL Labs APIs, designed for SSL/TLS assessment during a penetration test. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'activesupport/inflector' require 'json' require...

RIPS Scanner Directory Traversal

This module exploits a directory traversal vulnerability in the RIPS Scanner v0.54, allowing to read arbitrary files with the web server privileges. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModu...

Wordpress InBoundio Marketing PHP Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress InBoundio Marketing version 2.0. It allows to upload arbitrary php files and get remote code execution. This module has been tested successfully on WordPress InBoundio Marketing 2.0.3 with Wordpress 4.1.3 on Ubuntu 14.04 Server. Modul...

Python Meterpreter, Python Reverse HTTPS Stager

Run a meterpreter server in Python compatible with 2.5-2.7 & 3.1+. Tunnel communication over HTTP using SSL This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = :dynamic include...

Web-Dorado ECommerce WD for Joomla! search_category_id SQL Injection Scanner

This module will scan for hosts vulnerable to an unauthenticated SQL injection within the advanced search feature of the Web-Dorado ECommerce WD 1.2.5 and likely prior. Module Options msf use auxiliary/scanner/http/joomla/ecommercewdsqliscanner msf undefinedecommercewdsqliscanner show actions...

Java RMI Registry Interfaces Enumeration

This module gathers information from an RMI endpoint running an RMI registry interface. It enumerates the names bound in a registry and looks up each remote reference. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

WordPress All-in-One Migration Export

This module allows you to export Wordpress data such as the database, plugins, themes, uploaded files, etc via the All-in-One Migration plugin without authentication. Module Options msf use auxiliary/gather/wp/allinonemigrationexport msf undefinedallinonemigrationexport show actions ...actions...

GitLab Login Utility

This module attempts to login to a GitLab instance using a specific user/pass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Symantec Web Gateway Login Utility

This module will attempt to authenticate to a Symantec Web Gateway. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/symantecwebgateway' require...

Wordpress Work The Flow Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress Work The Flow plugin, version 2.5.2. The vulnerability allows for arbitrary file upload and remote code execution. Module Options msf use exploit/unix/webapp/wp/worktheflowupload msf undefinedworktheflowupload show actions...