AD CS Certificate Template Management

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AD CS Certificate Template Management', 'Description' = %q This module can create, read, update, and delete AD CS certificate templates from a...

Linksys E1500/E2500 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Linksys E1500/E2500 Remote Command Execution', 'Description' = %q Some Linksys Routers are vulnerable to an authenticated OS command injection...

Cambium CnPilot R200/r201 File Path Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cambium cnPilot r200/r201 File Path Traversal', 'Description' = %q This module exploits a File Path Traversal vulnerability in Cambium cnPilot...

Mac OS X Safari .webarchive File Format UXSS

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'uri' class MetasploitModule 'Mac OS X Safari .webarchive File Format UXSS', 'Description' = %q Generates a .webarchive file for Mac OS X Safari that will attemp...

Plixer Scrutinizer NetFlow And SFlow Analyzer HTTP Authentication Bypass

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Plixer Scrutinizer NetFlow and sFlow Analyzer HTTP Authentication Bypass', 'Description' = %q This will add an administrative account to...

iOS Safari Denial of Service with CSS

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "iOS Safari Denial of Service with CSS", 'Description' = %q This module exploits a vulnerability in WebKit on Apple iOS. If successful, the device...

IBM DB2 Db2rcmd.exe Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM DB2 db2rcmd.exe Command Execution Vulnerability', 'Description' = %q This module exploits a vulnerability in the Remote Command Server...

Brother Debut http Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Brother Debut http Denial Of Service', 'Description' = %q The Debut embedded HTTP server MSFLICENSE, 'Author' = 'z00n ', vulnerability disclosure...

Oracle TNS Listener SID Enumeration

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle TNS Listener SID Enumeration', 'Description' = %q This module simply queries the TNS listener for the Oracle SID. With Oracle 9.2.0.8 and...

SAP SOAP EPS_DELETE_FILE File Deletion

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module is based on, inspired by, or is a port of a plugin available in the Onapsis Bizploit Opensource ERP Penetration Testing framework -...

Oracle XML DB SID Discovery Via Brute Force

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle XML DB SID Discovery via Brute Force', 'Description' = %q This module attempts to retrieve the sid from the Oracle XML DB httpd server,...

ManageEngine NetFlow Analyzer Arbitrary File Download

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine NetFlow Analyzer Arbitrary File Download', 'Description' = %q This module exploits an arbitrary file download vulnerability in...

Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands', 'Description' = %q The EtherNet/IP CIP protocol allows a number of unauthenticated...

Viproy CUCDM IP Phone XML Services Call Forwarding Tool

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'Viproy CUCDM IP Phone XML Services - Call Forwarding Tool', 'Description' = %q The BVSMWeb portal in the web framework i...

SAP Unauthenticated WebService User Creation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Unauthenticated WebService User Creation', 'Description' = %q This module leverages an unauthenticated web service to submit a job which will...

Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'net/ssh/transport/session' require 'net/sftp' require 'openssl' class MetasploitModule 'Progress MOVEit SFTP Authentication Bypass for Arbitrary File Read',...

Oracle DB SQL Injection Via SYS.LT.FINDRICSET Evil Cursor Method

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle DB SQL Injection via SYS.LT.FINDRICSET Evil Cursor Method', 'Description' = %q This module will escalate an Oracle DB user to DBA by...

Peplink Balance Routers SQL Injection

class MetasploitModule 'Peplink Balance routers SQLi', 'Description' = %q Firmware versions up to 7.0.0-build1904 of Peplink Balance routers are affected by an unauthenticated SQL injection vulnerability in the bauth cookie, successful exploitation of the vulnerability allows an attacker to...

General Electric D20ME TFTP Server Buffer Overflow / Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework The General Electric D20 and possibly other devices have numerous buffer overruns in their TFTP servers and probably other servers. There are many buffer overruns like i...

OpenSSL TLS 1.1 and 1.2 AES-NI Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework auxiliary/dos/ssl/opensslaesni class MetasploitModule 'OpenSSL TLS 1.1 and 1.2 AES-NI DoS', 'Description' = %q The AES-NI implementation of OpenSSL 1.0.1c does not...

Dell OpenManage POST Request Heap Overflow (win32)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Dell OpenManage POST Request Heap Overflow win32', 'Description' = %q This module exploits a heap overflow in the Dell OpenManage Web Server...

HP Data Protector Manager RDS Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HP Data Protector Manager RDS DOS', 'Description' = %q This module causes a remote DOS on HP Data Protector's RDS service. By sending a malformed...

FileZilla FTP Server Malformed PORT Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FileZilla FTP Server Malformed PORT Denial of Service', 'Description' = %q This module triggers a Denial of Service condition in the FileZilla FT...

Mirage firewall for QubesOS 0.8.0-0.8.3 Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mirage firewall for QubesOS 0.8.0-0.8.3 Denial of Service DoS Exploit', 'Description' = %q This module allows remote attackers to cause a denial ...

NFR Agent Heap Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NFR Agent Heap Overflow Vulnerability', 'Description' = %q This module exploits a heap overflow in NFRAgent.exe, a component of Novell File...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load And Administrator Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset', 'Description' = %q The NVRmini 2...

Oracle Account Discovery

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'csv' class MetasploitModule 'Oracle Account Discovery', 'Description' = %q This module uses a list of well known default authentication credentials to discover...

Monkey HTTPD Header Parsing Denial of Service (Denial of Service)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Monkey HTTPD Header Parsing Denial of Service DoS', 'Description' = %q This module causes improper header parsing that leads to a segmentation...

Node.js HTTP Pipelining Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Node.js HTTP Pipelining Denial of Service', 'Description' = %q This module exploits a Denial of Service DoS condition in the HTTP parser of Node....

Tautulli 2.1.9 Shutdown Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tautulli v2.1.9 - Shutdown Denial of Service', 'Description' = 'Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the...

Samba lsa_io_privilege_set Heap Overflow

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Samba lsaioprivilegeset Heap Overflow', 'Description' = %q This module triggers a heap overflow in the LSA RPC service of the Samba daemon. ,...

PacketTrap TFTP Server 2.2.5459.0 Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'PacketTrap TFTP Server 2.2.5459.0 DoS', 'Description' = %q The PacketTrap TFTP server version 2.2.5459.0 can be brought down by sending a special...

Microsoft SRV.SYS Mailslot Write Corruption

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SRV.SYS Mailslot Write Corruption', 'Description' = %q This module triggers a kernel pool corruption bug in SRV.SYS. Each call to the...

Wireshark CLDAP Dissector Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wireshark CLDAP Dissector DOS', 'Description' = %q This module causes infinite recursion to occur within the CLDAP dissector by sending a special...

Drupal OpenID External Entity Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal OpenID External Entity Injection', 'Description' = %q This module abuses an XML External Entity Injection vulnerability on the OpenID modu...

Microsoft SQL Server Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SQL Server Command Execution', 'Description' = %q This module will execute a Windows command on a MSSQL/MSDE instance via the xpcmdshel...

Sendmail SMTP Address prescan Memory Corruption

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sendmail SMTP Address prescan Memory Corruption', 'Description' = %q This is a proof of concept denial of service module for Sendmail versions...

FreeBSD Remote NFS RPC Request Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FreeBSD Remote NFS RPC Request Denial of Service', 'Description' = %q This module sends a specially-crafted NFS Mount request causing a kernel...

ManageEngine Multiple Products Arbitrary File Download

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine Multiple Products Arbitrary File Download', 'Description' = %q This module exploits an arbitrary file download vulnerability in the...

Novell EDirectory DHOST Predictable Session Cookie

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Novell eDirectory DHOST Predictable Session Cookie', 'Description' = %q This module is able to predict the next session cookie value issued by th...

TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TrendMicro OfficeScanNT Listener Traversal Arbitrary File Access', 'Description' = %q This module tests for directory traversal vulnerability in...

SysAid Help Desk Administrator Account Creation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SysAid Help Desk Administrator Account Creation', 'Description' = %q This module exploits a vulnerability in SysAid Help Desk that allows an...

Mutiny 5 Arbitrary File Read And Delete

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mutiny 5 Arbitrary File Read and Delete', 'Description' = %q This module exploits the EditDocument servlet from the frontend on the Mutiny 5...

IBM Lotus Sametime WebPlayer Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM Lotus Sametime WebPlayer DoS', 'Description' = %q This module exploits a known flaw in the IBM Lotus Sametime WebPlayer version 8.5.2.1392 an...

Microsoft Host Integration Server 2006 Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Host Integration Server 2006 Command Execution Vulnerability', 'Description' = %q This module exploits a command-injection vulnerabilit...

General Electric D20 Password Recovery

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework This module grabs the device configuration from a GE D20M RTU and parses the usernames and passwords from it. class MetasploitModule 'General Electric D20 Password...

DarkComet Server Remote File Download

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'DarkComet Server Remote File Download Exploit', 'Description' = %q This module exploits an arbitrary file download vulnerability in the DarkComet...

Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rkelly' class MetasploitModule 'Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal', 'Description' = %q This module exploits a...

GE Proficy Cimplicity WebView Substitute.bcl Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'uri' class MetasploitModule 'GE Proficy Cimplicity WebView substitute.bcl Directory Traversal', 'Description' = %q This module abuses a directory traversal in G...

Microsoft Windows Browser Pool Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Windows Browser Pool DoS', 'Description' = %q This module exploits a denial of service flaw in the Microsoft Windows SMB service on...