Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability

This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username'...

F5 Networks Devices Management Interface Scanner

This module attempts to identify the web management interfaces of the following F5 Networks devices: BigIP, BigIQ, Enterprise Manager, ARX, and FirePass. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

Adobe Flash Player NetConnection Type Confusion

This module exploits a type confusion vulnerability in the NetConnection class on Adobe Flash Player. When using a correct memory layout this vulnerability allows to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like vectors, and ultimately accomplish remote code...

iPass Mobile Client Service Privilege Escalation

The named pipe, \IPEFSYSPCPIPE, can be accessed by normal users to interact with the iPass service. The service provides a LaunchAppSysMode command which allows to execute arbitrary commands as SYSTEM. Module Options msf use exploit/windows/local/ipass/launchapp msf undefinedlaunchapp show action...

Windows Meterpreter (Reflective Injection), Windows Reverse HTTPS Stager (winhttp)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTPS Windows winhttp This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework modu...

VNC Server (Reflective Injection), Windows Reverse HTTP Stager (winhttp)

Inject a VNC Dll via a reflective loader staged. Tunnel communication over HTTP Windows winhttp This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 533 include Msf::Payload::Stager...

Reflective DLL Injection, Windows Reverse HTTP Stager (winhttp)

Inject a DLL via a reflective loader. Tunnel communication over HTTP Windows winhttp This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 533 include Msf::Payload::Stager include...

Windows Meterpreter (Reflective Injection), Windows Reverse HTTP Stager (winhttp)

Inject the Meterpreter server DLL via the Reflective Dll Injection payload staged. Requires Windows XP SP2 or newer. Tunnel communication over HTTP Windows winhttp This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework modul...

Microsoft Windows Shell LNK Code Execution

This module exploits a vulnerability in the MS10-046 patch to abuse again the handling of Windows Shortcut files .LNK that contain an icon resource pointing to a malicious DLL. This creates an SMB resource to provide the payload and the trigger, and generates a LNK file which must be sent to the...

Microsoft Windows Shell LNK Code Execution

This module exploits a vulnerability in the MS10-046 patch to abuse again the handling of Windows Shortcut files .LNK that contain an icon resource pointing to a malicious DLL. This module creates the required files to exploit the vulnerability. They must be uploaded to an UNC path accessible by...

WordPress WPshop eCommerce Arbitrary File Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress WPshop eCommerce plugin from version 1.3.3.3 to 1.3.9.5. It allows to upload arbitrary PHP code and get remote code execution. This module has been tested successfully on WordPress WPshop eCommerce 1.3.9.5 with WordPress 4.1.3 on Ubun...

Brocade Enable Login Check Scanner

This module will test a range of Brocade network devices for a privileged logins and report successes. The device authentication mode must be set as 'aaa authentication enable default local'. Telnet authentication, e.g. 'enable telnet authentication', should not be enabled in the device...

F5 BigIP Access Policy Manager Session Exhaustion Denial of Service

This module exploits a resource exhaustion denial of service in F5 BigIP devices. An unauthenticated attacker can establish multiple connections with BigIP Access Policy Manager APM and exhaust all available sessions defined in customer license. In the first step of the BigIP APM negotiation the...

Samba _netr_ServerPasswordSet Uninitialized Credential State

This module checks if a Samba target is vulnerable to an uninitialized variable creds vulnerability. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba netrServerPasswordSet Uninitialized...

Generic DLL Injection From Shared Resource

This is a general-purpose module for exploiting conditions where a DLL can be loaded from a specified SMB share. This module serves payloads as DLLs over an SMB service. Module Options msf use exploit/windows/smb/generic/smbdllinjection msf undefinedsmbdllinjection show actions ...actions... msf...

Generic Web Application DLL Injection

This is a general-purpose module for exploiting conditions where a HTTP request triggers a DLL load from an specified SMB share. This module serves payloads as DLLs over an SMB service and allows an arbitrary HTTP URL to be called that would trigger the load of the DLL. Module Options msf use...

PHPMoAdmin 1.1.2 Remote Code Execution

This module exploits an arbitrary PHP command execution vulnerability due to a dangerous use of eval in PHPMoAdmin. Module Options msf use exploit/multi/http/phpmoadmin/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedexec show options ...show and set...

WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner

This module will scan given instances for an unauthenticated SQL injection within the CP Multi-View Calendar plugin v1.1.4 for Wordpress. Module Options msf use auxiliary/scanner/http/wordpress/cpcalendarsqli msf undefinedcpcalendarsqli show actions ...actions... msf undefinedcpcalendarsqli set...

Seagate Business NAS Unauthenticated Remote Command Execution

Some Seagate Business NAS devices are vulnerable to command execution via a local file include vulnerability hidden in the language parameter of the CodeIgniter session cookie. The vulnerability manifests in the way the language files are included in the code on the login page, and hence is open ...

Android Browser File Theft

This module steals the cookie, password, and autofill databases from the Browser application on AOSP 4.3 and below. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Android Browser File Theft',...

D-Link/TRENDnet NCC Service Command Injection

This module exploits a remote command injection vulnerability on several routers. The vulnerability exists in the ncc service, while handling ping commands. This module has been tested on a DIR-626L emulated environment. Several D-Link and TRENDnet devices are reported as affected, including:...

Printer File Deletion Scanner

This module deletes a file on a set of printers using the Printer Job Language PJL protocol. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "rex/proto/pjl" class MetasploitModule "Printer File Deletion...

Printer File Upload Scanner

This module uploads a file to a set of printers using the Printer Job Language PJL protocol. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require "rex/proto/pjl" class MetasploitModule "Printer File Upload Scanner"...

WordPress WP EasyCart Plugin Privilege Escalation

The WordPress WP EasyCart plugin from version 1.1.30 to 3.0.20 allows authenticated users of any user level to set any system option via a lack of validation in the ecajaxupdateoption and ecajaxclearalltaxrates functions located in /inc/admin/adminajaxfunctions.php. The module first changes the...

mDNS Query

This module sends mDNS queries, which are really just normal UDP DNS queries done usually over multicast on a different port, 5353. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'mDNS Query',...

LLMNR Query

This module sends LLMNR queries, which are really just normal UDP DNS queries done usually over multicast on a different port, 5355. Targets other than the default RHOSTS' 224.0.0.252 should not respond but may anyway. This module requires Metasploit: https://metasploit.com/download Current sourc...

Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. Module Options msf use auxiliary/gather/solarwinds/orionsqli msf undefinedorionsqli show actions ...actions... msf undefinedorionsqli set ACTION msf undefinedorionsqli show options...

WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner

This module attempts to exploit a UNION-based SQL injection in Contus Video Gallery for Wordpress version 2.7 and likely prior in order if the instance is vulnerable. Module Options msf use auxiliary/scanner/http/wp/contusvideogallerysqli msf undefinedcontusvideogallerysqli show actions...

D-Link DCS-931L File Upload

This module exploits a file upload vulnerability in D-Link DCS-931L network cameras. The setFileUpload functionality allows authenticated users to upload files to anywhere on the file system, allowing system files to be overwritten, resulting in execution of arbitrary commands. This module has be...

WordPress Admin Shell Upload

This module will generate a plugin, pack the payload into it and upload it to a server running WordPress provided valid admin credentials are used. Module Options msf use exploit/unix/webapp/wp/adminshellupload msf undefinedadminshellupload show actions ...actions... msf undefinedadminshellupload...

Chef Web UI Brute Force Utility

This module attempts to login to Chef Web UI server instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. It will also test for the default login admin:p@ssw0rd1. This module requires Metasploit: https://metasploit.com/download Current...

Zabbix Server Brute Force Utility

This module attempts to login to Zabbix server instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. It will also test for the Zabbix default login Admin:zabbix and guest access. This module requires Metasploit:...

Javascript Injection for Eval-based Unpackers

This module generates a Javascript file that executes arbitrary code when an eval-based unpacker is run on it. Works against js-beautify's PACKER unpacker. Module Options msf use exploit/multi/fileformat/js/unpackerevalinjection msf undefinedunpackerevalinjection show actions ...actions... msf...

Chromecast Web Server Scanner

This module scans for the Chromecast web server on port 8008/TCP, and can be used to discover devices which can be targeted by other Chromecast modules, such as chromecastyoutube. This module requires Metasploit: https://metasploit.com/download Current source:...

Amazon Fire TV YouTube Remote Control

This module acts as a simple remote control for the Amazon Fire TV's YouTube app. Tested on the Amazon Fire TV Stick. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Amazon Fire TV YouTube Remo...

SMB Version Detection

Fingerprint and display version information about SMB servers. Protocol information and host operating system if available will be reported. Host operating system detection requires the remote server to support version 1 of the SMB protocol. Compression and encryption capability negotiation is on...

D-Link Devices HNAP SOAPAction-Header Command Execution

Different D-Link Routers are vulnerable to OS command injection in the HNAP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested on a DIR-645 device. The following devices are also reported as affected:...

Windows Manage PXE Exploit Server

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid...

PXE Boot Exploit Server

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid...

WordPress Holding Pattern Theme Arbitrary File Upload

This module exploits a file upload vulnerability in all versions of the Holding Pattern theme found in the uploadfile.php script which contains no session or file validation. It allows unauthenticated users to upload files of any type and subsequently execute PHP scripts in the context of the web...

Netgear Unauthenticated SOAP Password Extractor

This module exploits an authentication bypass vulnerability in different Netgear devices. It allows to extract the password for the remote management interface. This module has been tested on a Netgear WNDR3700v4 - V1.0.1.42, but other devices are reported as vulnerable: NetGear WNDR3700v4 -...

Maarch LetterBox Unrestricted File Upload

This module exploits a file upload vulnerability on Maarch LetterBox 2.8 due to a lack of session and file validation in the filetoindex.php script. It allows unauthenticated users to upload files of any type and subsequently execute PHP scripts in the context of the web server. Module Options ms...

SixApart MovableType Storable Perl Code Execution

This module exploits a serialization flaw in MovableType before 5.2.12 to execute arbitrary code. The default nondestructive mode depends on the target server having the Object::MultiType and DateTime Perl modules installed in Perl's @INC paths. The destructive mode of operation uses only require...

ElasticSearch Search Groovy Sandbox Bypass

This module exploits a remote command execution RCE vulnerability in ElasticSearch, exploitable by default on ElasticSearch prior to 1.4.3. The bug is found in the REST API, which does not require authentication, where the search function allows groovy code execution and its sandbox can be bypass...

Android Browser RCE Through Google Play Store XFO

This module combines two vulnerabilities to achieve remote code execution on affected Android devices. First, the module exploits CVE-2014-6041, a Universal Cross-Site Scripting UXSS vulnerability present in versions of Android's open source stock browser the AOSP Browser prior to 4.4. Second, th...

WordPress WPLMS Theme Privilege Escalation

The WordPress WPLMS theme from version 1.5.2 to 1.8.4.1 allows an authenticated user of any user level to set any system option due to a lack of validation in the importdata function of /includes/func.php. The module first changes the admin e-mail address to prevent any notifications being sent t...

Windows File Gather File from Raw NTFS

This module gathers a file using the raw NTFS device, bypassing some Windows restrictions such as open file with write lock. Because it avoids the usual file locking issues, it can be used to retrieve files such as NTDS.dit. This module requires Metasploit: https://metasploit.com/download Current...

MySQL Login Utility

This module simply queries the MySQL instance for a specific user/pass default is root with blank. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/credentialcollection' require...

Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution

Ektron 8.5, 8.7 use exploit/windows/http/ektron/xsltexecws msf undefinedxsltexecws show actions ...actions... msf undefinedxsltexecws set ACTION msf undefinedxsltexecws show options ...show and set options... msf undefinedxsltexecws run This module requires Metasploit:...

WordPress Ultimate CSV Importer User Table Extract

Due to lack of verification of a visitor's permissions, it is possible to execute the 'export.php' script included in the default installation of the Ultimate CSV Importer plugin and retrieve the full contents of the user table in the WordPress installation. This results in full disclosure of...