MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure

This module will use the Microsoft XMLDOM object to enumerate a remote machine's filenames. It will try to do so against Internet Explorer 8 and Internet Explorer 9. To use it, you must supply your own list of file paths. Each file path should look like this: c:\windows\system32\calc.exe Module...

HP Network Node Manager I PMD Buffer Overflow

This module exploits a stack buffer overflow in HP Network Node Manager I NNMi. The vulnerability exists in the pmd service, due to the insecure usage of functions like strcpy and strcat while handling stackoption packets with user controlled data. In order to bypass ASLR this module uses a...

Arris DG950A Cable Modem Wifi Enumeration

This module will extract WEP keys and WPA preshared keys from Arris DG950A cable modems. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Arris DG950A Cable Modem Wifi Enumeration', 'Description...

Android Open Source Platform (AOSP) Browser UXSS

This module exploits a Universal Cross-Site Scripting UXSS vulnerability present in all versions of Android's open source stock browser before 4.4, and Android apps running on 'Android Open Source Platform AOSP Browser UXSS', 'Description' = %q This module exploits a Universal Cross-Site Scriptin...

PostgreSQL Login Utility

This module attempts to authenticate against a PostgreSQL instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. Note that passwords may be either plaintext or MD5 formatted hashes. This module requires Metasploit:...

HP System Management Homepage Login Utility

This module attempts to login to HP System Management Homepage using host operating system authentication. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/smh' require...

ARRIS / Motorola SBG6580 Cable Modem SNMP Enumeration Module

This module allows SNMP enumeration of the ARRIS / Motorola SURFboard SBG6580 Series Wi-Fi Cable Modem Gateway. It supports the username and password for the device user interface as well as wireless network keys and information. The default community used is "public". This module requires...

ManageEngine Eventlog Analyzer Arbitrary File Upload

This module exploits a file upload vulnerability in ManageEngine Eventlog Analyzer. The vulnerability exists in the agentUpload servlet which accepts unauthenticated file uploads and handles zip file contents in an insecure way. By combining both weaknesses a remote attacker can achieve remote co...

ManageEngine Desktop Central StatusUpdate Arbitrary File Upload

This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral v7 to v9 build 90054 including the MSP versions. A malicious user can upload a JSP file into the web root without authentication, leading to arbitrary code execution as SYSTEM. Some early builds of version ...

Linux Gather NetworkManager 802-11-Wireless-Security Credentials

This module collects 802-11-Wireless-Security credentials such as Access-Point name and Pre-Shared-Key from Linux NetworkManager connection configuration files. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class...

ManageEngine DeviceExpert User Credentials

This module extracts usernames and salted MD5 password hashes from ManageEngine DeviceExpert version 5.9 build 5980 and prior. This module has been tested successfully on DeviceExpert version 5.9.7 build 5970. Module Options msf use auxiliary/scanner/http/manageengine/deviceexpertusercreds msf...

Wordpress SlideShow Gallery Authenticated File Upload

The Wordpress SlideShow Gallery plugin contains an authenticated file upload vulnerability. An attacker can upload arbitrary files to the upload folder. Since the plugin uses its own file upload mechanism instead of the WordPress API, it's possible to upload any file type. Module Options msf use...

ActualAnalyzer 'ant' Cookie Command Execution

This module exploits a command execution vulnerability in ActualAnalyzer version 2.81 and prior. The 'aa.php' file allows unauthenticated users to execute arbitrary commands in the 'ant' cookie. Module Options msf use exploit/unix/webapp/actualanalyzer/antcookieexec msf undefinedantcookieexec sho...

SSDP ssdp:all M-SEARCH Amplification Scanner

Discover SSDP amplification possibilities This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SSDP ssdp:all M-SEARCH Amplification Scanner', 'Description' = 'Discover SSDP amplification...

Railo Remote File Include

This module exploits a remote file include vulnerability in Railo, tested against version 4.2.1. First, a call using a vulnerable line in thumbnail.cfm allows an attacker to download an arbitrary PNG file. By appending a .cfm, and taking advantage of a directory traversal, an attacker can append...

Apple TV Video Remote Control

This module plays a video on an AppleTV device. Note that AppleTV can be somewhat picky about the server that hosts the video. Tested servers include default IIS, default Apache, and Ruby's WEBrick. For WEBrick, the default MIME list may need to be updated, depending on what media file is to be...

Apple TV Image Remote Control

This module will show an image on an AppleTV device for a period of time. Some AppleTV devices are actually password-protected, in that case please set the PASSWORD datastore option. For password brute forcing, please see the module auxiliary/scanner/http/appletvlogin. This module requires...

AppleTV AirPlay Login Utility

This module attempts to authenticate to an AppleTV service with the username, 'AirPlay'. The device has two different access control modes: OnScreen and Password. The difference between the two is the password in OnScreen mode is numeric-only and four digits long, which means when this option is...

NTP Mode 6 REQ_NONCE DRDoS Scanner

This module identifies NTP servers which permit mode 6 REQNONCE requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to REQNONCE requests with a response larger than the request, allowing remote attackers to cause a distributed, reflected denial of...

NTP Mode 7 GET_RESTRICT DRDoS Scanner

This module identifies NTP servers which permit "reslist" queries and obtains the list of restrictions placed on various network interfaces, networks or hosts. The reslist feature allows remote attackers to cause a distributed, reflected denial of service aka, "DRDoS" or traffic amplification via...

NTP Mode 6 UNSETTRAP DRDoS Scanner

This module identifies NTP servers which permit mode 6 UNSETTRAP requests that can be used to conduct DRDoS attacks. In some configurations, NTP servers will respond to UNSETTRAP requests with multiple packets, allowing remote attackers to cause a distributed, reflected denial of service aka,...

Netcore Router Udp 53413 Backdoor

Routers manufactured by Netcore, a popular brand for networking equipment in China, have a wide-open backdoor that can be fairly easily exploited by attackers. These products are also sold under the Netis brand name outside of China. This backdoor allows cyber criminals to easily run arbitrary co...

NTP Mode 7 PEER_LIST_SUM DoS Scanner

This module identifies NTP servers which permit "PEERLISTSUM" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service aka, "DRDoS" or traffic amplification via spoofed requests...

NTP Mode 7 PEER_LIST DoS Scanner

This module identifies NTP servers which permit "PEERLIST" queries and return responses that are larger in size or greater in quantity than the request, allowing remote attackers to cause a distributed, reflected denial of service aka, "DRDoS" or traffic amplification via spoofed requests. Module...

GDB Server Remote Payload Execution

This module attempts to execute an arbitrary payload on a loose gdbserver service. Module Options msf use exploit/multi/gdb/gdb/serverexec msf undefinedserverexec show actions ...actions... msf undefinedserverexec set ACTION msf undefinedserverexec show options ...show and set options... msf...

IP Board Login Auxiliary Module

This module attempts to validate user provided credentials against an IP Board web application. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'metasploit/framework/loginscanner/ipboard' require...

GlassFish Brute Force Utility

This module attempts to login to GlassFish instance using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. It will also try to do an authentication bypass against older versions of GlassFish. Note: by default, GlassFish 4.0 requires HTTPS, which...

SolarWinds Storage Manager Authentication Bypass

This module exploits an authentication bypass vulnerability in Solarwinds Storage Manager. The vulnerability exists in the AuthenticationFilter, which allows to bypass authentication with specially crafted URLs. After bypassing authentication, is possible to use a file upload function to achieve...

Yokogawa BKBCopyD.exe Client

This module allows an unauthenticated user to interact with the Yokogawa CENTUM CS3000 BKBCopyD.exe service through the PMODE, RETR and STOR operations. Module Options msf use auxiliary/admin/scada/yokogawa/bkbcopydclient msf undefinedbkbcopydclient show actions ...actions... msf...

Desktop Linux Password Stealer and Privilege Escalation

This module steals the user password of an administrative user on a desktop Linux system when it is entered for unlocking the screen or for doing administrative actions using PolicyKit. Then, it escalates to root privileges using sudo and the stolen user password. It exploits the design weakness...

WordPress custom-contact-forms Plugin SQL Upload

The WordPress custom-contact-forms plugin use auxiliary/admin/http/wp/customcontactforms msf undefinedcustomcontactforms show actions ...actions... msf undefinedcustomcontactforms set ACTION msf undefinedcustomcontactforms show options ...show and set options... msf undefinedcustomcontactforms ru...

Wordpress XMLRPC DoS

Wordpress XMLRPC parsing is vulnerable to a XML based denial of service. This vulnerability affects Wordpress 3.5 - 3.9.2 3.8.4 and 3.7.4 are also patched. Module Options msf use auxiliary/dos/http/wordpress/xmlrpcdos msf undefinedxmlrpcdos show actions ...actions... msf undefinedxmlrpcdos set...

HybridAuth install.php PHP Code Execution

This module exploits a PHP code execution vulnerability in HybridAuth versions 2.0.9 to 2.2.2. The install file 'install.php' is not removed after installation allowing unauthenticated users to write PHP code to the application configuration file 'config.php'. Note: This exploit will overwrite th...

Wordpress XML-RPC Username/Password Login Scanner

This module attempts to authenticate against a Wordpress-site via XMLRPC using username and password combinations indicated by the USERFILE, PASSFILE, and USERPASSFILE options. This module requires Metasploit: https://metasploit.com/download Current source:...

Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection

This module exploits a vulnerability found in Dell SonicWALL Scrutinizer. The methodDetail parameter in exporters.php allows an attacker to write arbitrary files to the file system with an SQL Injection attack, and gain remote code execution under the context of SYSTEM for Windows, or as Apache f...

BulletProof FTP Client BPS Buffer Overflow

This module exploits a stack-based buffer overflow vulnerability in BulletProof FTP Client 2010, caused by an overly long hostname. By persuading the victim to open a specially-crafted .BPS file, a remote attacker could execute arbitrary code on the system or cause the application to crash. This...

Linux Gather Gnome-Commander Creds

This module collects the clear text passwords stored by Gnome-commander, a GUI file explorer for GNOME. Typically, these passwords are stored in the user's home directory, at /.gnome-commander/connections. This module requires Metasploit: https://metasploit.com/download Current source:...

Echo Command Encoder

This encoder uses echo and backlash escapes to avoid commonly restricted characters. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Echo Command Encoder', 'Description' = %q This encoder uses...

Perl Command Encoder

This encoder uses perl to avoid commonly restricted characters. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Perl Command Encoder', 'Description' = %q This encoder uses perl to avoid commonl...

MQAC.sys Arbitrary Write Privilege Escalation

A vulnerability within the MQAC.sys module allows an attacker to overwrite an arbitrary location in kernel memory. This module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process. Module Options msf use exploit/windows/local/mqac/write msf undefinedwrite show action...

JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. This module requires Metasploit: https://metasploit.com/download Current...

Joomla Bruteforce Login Utility

This module attempts to authenticate to Joomla 2.5. or 3.0 through bruteforce attacks This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Joomla Bruteforce Login Utility', 'Description' = 'This...

MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation

A vulnerability within Microsoft Bluetooth Personal Area Networking module, BthPan.sys, can allow an attacker to inject memory controlled by the attacker into an arbitrary location. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently callin...

Multi Manage DbVisualizer Query

Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases With GUI. The remote database can be accessed from the command line without the need to authenticate, and this module abuses this functionality to query and will store the results. Please note: backslash quot...

Advantech WebAccess dvs.ocx GetColor Buffer Overflow

This module exploits a buffer overflow vulnerability in Advantec WebAccess. The vulnerability exists in the dvs.ocx ActiveX control, where a dangerous call to sprintf can be reached with user controlled data through the GetColor function. This module has been tested successfully on Windows XP SP3...

Multi Manage DbVisualizer Add Db Admin

Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases With GUI. The remote database can be accessed from the command line without the need to authenticate, which can be abused to create an administrator in the database with the proper database permissions. Note:...

VirtualBox Guest Additions VBoxGuest.sys Privilege Escalation

A vulnerability within the VBoxGuest driver allows an attacker to inject memory they control into an arbitrary location they define. This can be used by an attacker to overwrite HalDispatchTable+0x4 and execute arbitrary code by subsequently calling NtQueryIntervalProfile on Windows XP SP3 system...

Multi Gather DbVisualizer Connections Settings

DbVisualizer stores the user database configuration in dbvis.xml. This module retrieves the connections settings from this file and decrypts the encrypted passwords. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework...

WordPress WPTouch Authenticated File Upload

The WordPress WPTouch plugin contains an authenticated file upload vulnerability. A wp-nonce CSRF token is created on the backend index page and the same token is used on handling ajax file uploads through the plugin. By sending the captured nonce with the upload, we can upload arbitrary files to...

Flash "Rosetta" JSONP GET/POST Response Disclosure

A website that serves a JSONP endpoint that accepts a custom alphanumeric callback of 1200 chars can be abused to serve an encoded swf payload that steals the contents of a same-domain URL. Flash use auxiliary/gather/flash/rosettajsonpurldisclosure msf undefinedrosettajsonpurldisclosure show...