Metasploit Auxiliary Module & Exploit Database (DB)

This module will reset the admin password on a 2Wire wireless router. This is done by using the /xslt page where authentication is not required, thus allowing configuration changes (such as resetting the password) as administrators.

• MODULE DETAILS
• CVE-2007-4387 Exploit
• OSVDB-37667 Exploit
• BID-36075 Exploit
• http://seclists.org/bugtraq/2... Exploit

This modules exploits a remote registry access flaw in the BackupExec Windows Server RPC service. This vulnerability was discovered by Pedram Amini and is based on the NDR stub information information posted to openrce.org. Please see the action list for the different attack modes.

• MODULE DETAILS
• OSVDB-17627 Exploit
• CVE-2005-0771 Exploit
• http://www.idefense.com/appli... Exploit

This module tests for a logic vulnerability in the Cisco VPN Concentrator 3000 series. It is possible to execute some FTP statements without authentication (CWD, RNFR, MKD, RMD, SIZE, CDUP). It also appears to have some memory leak bugs when working with CWD commands. This module simply creates an arbitrary directory, verifies that the directory has been created, then deletes it and verifies deletion to confirm the bug.

• MODULE DETAILS
• BID-19680 Exploit
• CVE-2006-4313 Exploit
• http://www.cisco.com/warp/pub... Exploit
• OSVDB-28139 Exploit
• OSVDB-28138 Exploit

This module is able to predict the next session cookie value issued by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run this module, wait until the real administrator logs in, then specify the predicted cookie value to hijack their session.

• MODULE DETAILS
• OSVDB-60035 Exploit

EMC AlphaStor Device Manager is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.

• MODULE DETAILS
• http://labs.idefense.com/inte... Exploit
• OSVDB-45715 Exploit
• CVE-2008-2157 Exploit
• BID-29398 Exploit

This module exploits a directory traversal vulnreability in the XCRC command implemented in versions of Titan FTP up to and including 8.10.1125. By making sending multiple XCRC command, it is possible to disclose the contents of any file on the drive with a simple CRC "brute force" attack. Although the daemon runs with SYSTEM privileges, access is limited to files that reside on the same drive as the FTP server's root directory.

• MODULE DETAILS
• OSVDB-65533 Exploit
• http://seclists.org/bugtraq/2... Exploit

This module abuses the 'mimencode' binary present within ContentKeeper Web filtering appliances to retrieve arbitrary files outside of the webroot.

• MODULE DETAILS
• OSVDB-54551 Exploit
• http://www.aushack.com/200904... Exploit

The Iomega StorCenter Pro Network Attached Storage device web interface increments sessions IDs, allowing for simple brute force attacks to bypass authentication and gain administrative access.

• MODULE DETAILS
• OSVDB-55586 Exploit
• CVE-2009-2367 Exploit

Detect the Tomcat administration interface.

• MODULE DETAILS
• http://tomcat.apache.org/ Exploit

This module tests whether a directory traversal vulnerablity is present in Trend Micro DLP (Data Loss Prevention) Appliance v5.5 build <= 1294. The vulnerability appears to be actually caused by the Tomcat UTF-8 bug which is implemented in module tomcat_utf8_traversal CVE 2008-2938. This module simply tests for the same bug with Trend Micro specific settings. Note that in the Trend Micro appliance, /etc/shadow is not used and therefore password hashes are stored and anonymously accessible in the passwd file.

• MODULE DETAILS
• http://tomcat.apache.org/ Exploit
• OSVDB-47464 Exploit
• OSVDB-73447 Exploit
• CVE-2008-2938 Exploit
• http://www.securityfocus.com/... Exploit
• EDB-17388 Exploit
• BID-48225 Exploit

This module exploits a file disclosure vulnerability in the jumpUrl mechanism of Typo3. This flaw can be used to read any file that the web server user account has access to.

• MODULE DETAILS
• OSVDB-52048 Exploit
• CVE-2009-0815 Exploit
• http://secunia.com/advisories... Exploit
• EDB-8038 Exploit
• http://typo3.org/teams/securi... Exploit

This module exploits known default encryption keys found in the TYPO3 Winstaller. This flaw allows for file disclosure in the jumpUrl mechanism. This issue can be used to read any file that the web server user account has access to view. The method used to create the juhash (short MD5 hash) was altered in later versions of Typo3. Use the show actions command to display and select the version of TYPO3 in use (defaults to the older method of juhash creation).

• MODULE DETAILS
• http://typo3winstaller.source... Exploit

This module will turn on a remote machine with a network card that supports wake-on-lan (or MagicPacket). In order to use this, you must know the machine's MAC address in advance. The current default MAC address is just an example of how your input should look like. The password field is optional. If present, it should be in this hex format: 001122334455, which is translated to "0x001122334455" in binary. Note that this should be either 4 or 6 bytes long.

• MODULE DETAILS

This module exploits a command-injection vulnerability in Microsoft Host Integration Server 2006.

• MODULE DETAILS
• MSB-MS08-059 Exploit
• CVE-2008-3466 Exploit
• OSVDB-49068 Exploit
• http://labs.idefense.com/inte... Exploit

This module will execute a Windows command on a MSSQL/MSDE instance via the xp_cmdshell procedure. A valid username and password is required to use this module

• MODULE DETAILS
• http://msdn.microsoft.com/en-... Exploit

This module will allow for simple SQL statements to be executed against a MSSQL/MSDE instance given the appropiate credentials.

• MODULE DETAILS
• http://www.attackresearch.com Exploit
• http://msdn.microsoft.com/en-... Exploit

This module allows for simple SQL statements to be executed against a MySQL instance given the appropriate credentials.

• MODULE DETAILS

This module tests for directory traversal vulnerability in the UpdateAgent function in the OfficeScanNT Listener (TmListen.exe) service in Trend Micro OfficeScan. This allows remote attackers to read arbitrary files as SYSTEM via dot dot sequences in an HTTP request.

• MODULE DETAILS
• OSVDB-48730 Exploit
• CVE-2008-2439 Exploit
• BID-31531 Exploit
• http://www.trendmicro.com/ftp... Exploit

This module uses a list of well known default authentication credentials to discover easily guessed accounts.

• MODULE DETAILS
• http://www.petefinnigan.com/d... Exploit
• http://seclists.org/fulldiscl... Exploit

This module provides a simple way to scan an Oracle database server for configuration parameters that may be useful during a penetration test. Valid database credentials must be provided for this module to run.

• MODULE DETAILS

This module exploits an authentication bypass vulnerability in login.php in order to execute arbitrary code via a command injection vulnerability in property_box.php. This module was tested against Oracle Secure Backup version 10.3.0.1.0 (Win32).

• MODULE DETAILS
• CVE-2009-1977 Exploit
• OSVDB-55903 Exploit
• CVE-2009-1978 Exploit
• OSVDB-55904 Exploit
• http://www.zerodayinitiative.... Exploit
• http://www.zerodayinitiative.... Exploit

This module will create a java class which enables the execution of OS commands.

• MODULE DETAILS
• https://www.metasploit.com/us... Exploit

This module simply attempts to discover the protected SID.

• MODULE DETAILS
• https://www.metasploit.com/us... Exploit
• http://www.red-database-secur... Exploit

This module exploits a vulnerability in the FOLD command of the University of Washington ipop2d service. By specifying an arbitrary folder name it is possible to retrieve any file which is world or group readable by the user ID of the POP account. This vulnerability can only be exploited with a valid username and password. The From address is the file owner.

• MODULE DETAILS
• OSVDB-368 Exploit
• BID-1484 Exploit

This module will allow for simple SQL statements to be executed against a PostgreSQL instance given the appropiate credentials.

• MODULE DETAILS
• www.postgresql.org Exploit

This module abuses a directory traversal flaw in Interactive Graphical SCADA System v9.00. In conjunction with the traversal flaw, if opcode 0x17 is sent to the dc.exe process, an attacker may be able to execute arbitrary system commands.

• MODULE DETAILS
• CVE-2011-1566 Exploit
• OSVDB-72349 Exploit
• http://aluigi.org/adv/igss_8-... Exploit

The Schneider Modicon Quantum series of Ethernet cards store usernames and passwords for the system in files that may be retrieved via backdoor access. This module is based on the original 'modiconpass.rb' Basecamp module from DigitalBond.

• MODULE DETAILS
• http://www.digitalbond.com/to... Exploit

The EtnerNet/IP CIP protocol allows a number of unauthenticated commands to a PLC which implements the protocol. This module implements the CPU STOP command, as well as the ability to crash the Ethernet card in an affected device. This module is based on the original 'ethernetip-multi.rb' Basecamp module from DigitalBond.

• MODULE DETAILS
• http://www.digitalbond.com/to... Exploit

This module is useful when checking an entire network of SMB hosts for the presence of a known file or directory. An example would be to scan all systems for the presence of antivirus or known malware outbreak. Typically you must set RPATH, SMBUser, SMBDomain and SMBPass to operate correctly.

• MODULE DETAILS

This module uploads a file to a target share and path. The only reason to use this module is if your existing SMB client is not able to support the features of the Metasploit Framework that you need, like pass-the-hash authentication.

• MODULE DETAILS

This module will transfer a file to or from a remote TFTP server. Note that the target must be able to connect back to the Metasploit system, and NAT traversal for TFTP is often unsupported. Two actions are supported: "Upload" and "Download," which behave as one might expect -- use 'set action Actionname' to use either mode of operation. If "Download" is selected, at least one of FILENAME or REMOTE_FILENAME must be set. If "Upload" is selected, either FILENAME must be set to a valid path to a source file, or FILEDATA must be populated. FILENAME may be a fully qualified path, or the name of a file in the Msf::Config.local_directory or Msf::Config.data_directory.

• MODULE DETAILS
• http://www.faqs.org/rfcs/rfc1... Exploit
• http://www.networksorcery.com... Exploit

This module will log into the Web API of VMWare and try to power off a specified Virtual Machine.

• MODULE DETAILS

This module will log into the Web API of VMWare and 'tag' a specified Virtual Machine. It does this by logging a user event with user supplied text

• MODULE DETAILS

This module exploits an Authentication bypass Vulnerability in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy listener on LPORT and proxies to the target server The AUTOVNC option requires that vncviewer be installed on the attacking machine.

• MODULE DETAILS
• BID-17978 Exploit
• OSVDB-25479 Exploit
• http://secunia.com/advisories... Exploit
• CVE-2006-2369 Exploit

This module can be used to enable auto-answer mode for the D-Link i2eye video conferencing system. Once this setting has been flipped, the device will accept incoming video calls without acknowledgement. The NetMeeting software included in Windows XP can be used to connect to this device. The i2eye product is no longer supported by the vendor and all models have reached their end of life (EOL).

• MODULE DETAILS
• OSVDB-66842 Exploit
• http://blog.metasploit.com/20... Exploit
• http://www.kb.cert.org/vuls/i... Exploit

This module provides the ability to reboot a VxWorks target through WDBRPC

• MODULE DETAILS
• OSVDB-66842 Exploit
• http://blog.metasploit.com/20... Exploit
• http://www.kb.cert.org/vuls/i... Exploit

This module abuses a flaw in the Zend Java Bridge Component of the Zend Server Framework. By sending a specially crafted packet, an attacker may be able to execute arbitrary code. NOTE: This module has only been tested with the Win32 build of the software.

• MODULE DETAILS
• OSVDB-71420 Exploit
• http://www.zerodayinitiative.... Exploit
• EDB-17078 Exploit

This module uses John the Ripper to identify weak passwords that have been acquired as hashed files (loot) or raw LANMAN/NTLM hashes (hashdump). The goal of this module is to find trivial passwords in a short amount of time. To crack complex passwords or use large wordlists, John the Ripper should be used outside of Metasploit. This initial version just handles LM/NTLM credentials from hashdump and uses the standard wordlist and rules.

• MODULE DETAILS

This module uses John the Ripper to identify weak passwords that have been acquired from the mssql_hashdump module. Passwords that have been successfully cracked are then saved as proper credentials

• MODULE DETAILS

This module uses John the Ripper to identify weak passwords that have been acquired from the oracle_hashdump module. Passwords that have been successfully cracked are then saved as proper credentials

• MODULE DETAILS

This module attempts to crack Postgres SQL md5 password hashes. It creates hashes based on information saved in the MSF Database such as hostnames, usernames, passwords, and database schema information. The user can also supply an additional external wordlist if they wish.

• MODULE DETAILS

This module is a scanner which can detect Broken NAT (network address translation) implementations, which could result in a inability to reach ports on remote machines. Typically, these ports will appear in nmap scans as 'filtered'/'closed'.

• MODULE DETAILS
• https://github.com/claudijd/B... Exploit
• http://www.slideshare.net/cla... Exploit

This auxiliary module is a modular web crawler, to be used in conjuntion with wmap (someday) or standalone.

• MODULE DETAILS

This module performs a Denial of Service Attack against the ISC DHCP server, versions 4.1 before 4.1.1-P1 and 4.0 before 4.0.2-P1. It sends out a DHCP Request message with a 0-length client_id option for an IP address on the appropriate range for the dhcp server. When ISC DHCP Server tries to hash this value it exits abnormally.

• MODULE DETAILS
• CVE-2010-2156 Exploit
• OSVDB-65246 Exploit
• EDB-14185 Exploit

This module causes a remote DOS on HP Data Protector's RDS service. By sending a malformed packet to port 1530, _rm32.dll causes RDS to crash due to an enormous size for malloc().

• MODULE DETAILS
• CVE-2011-0514 Exploit
• OSVDB-70617 Exploit
• EDB-15940 Exploit

This module triggers a use-after-free vulnerability in the Apache Software Foundation mod_isapi extension. In order to reach the vulnerable code, the target server must have an ISAPI module installed and configured. By making a request that terminates abnormally (either an aborted TCP connection or an unsatisfied chunked request), mod_isapi will unload the ISAPI extension. Later, if another request comes for that ISAPI module, previously obtained pointers will be used resulting in an access violation or potentially arbitrary code execution. Although arbitrary code execution is theoretically possible, a real-world method of invoking this consequence has not been proven. In order to do so, one would need to find a situation where a particular ISAPI module loads at an image base address that can be re-allocated by a remote attacker. Limited success was encountered using two separate ISAPI modules. In this scenario, a second ISAPI module was loaded into the same memory area as the previously unloaded module.

• MODULE DETAILS
• CVE-2010-0425 Exploit
• OSVDB-62674 Exploit
• BID-38494 Exploit
• https://issues.apache.org/bug... Exploit
• http://www.gossamer-threads.c... Exploit
• http://www.senseofsecurity.co... Exploit
• EDB-11650 Exploit

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

• MODULE DETAILS
• CVE-2010-2227 Exploit
• OSVDB-66319 Exploit
• BID-41544 Exploit

There is a format string vulnerability within the SonicWALL SSL-VPN Appliance - 200, 2000 and 4000 series. Arbitrary memory can be read or written to, depending on the format string used. There appears to be a length limit of 127 characters of format string data. With physical access to the device and debugging, this module may be able to be used to execute arbitrary code remotely.

• MODULE DETAILS
• BID-35145 Exploit
• OSVDB-54881 Exploit
• http://www.aushack.com/200905... Exploit

Avahi-daemon versions prior to 0.6.24 can be DoS'd with an mDNS packet with a source port of 0

• MODULE DETAILS
• CVE-2008-5081 Exploit
• OSVDB-50929 Exploit

This module exploits a kernel based overflow when sending abnormal PPTP Control Data packets to Microsoft Windows 2000 SP0-3 and XP SP0-1 based PPTP RAS servers (Remote Access Services). Kernel memory is overwritten resulting in a BSOD. Code execution may be possible however this module is only a DoS.

• MODULE DETAILS
• BID-5807 Exploit
• CVE-2002-1214 Exploit
• OSVDB-13422 Exploit
• MSB-MS02-063 Exploit

This module triggers a heap overflow in the LSA RPC service of the Samba daemon.

• MODULE DETAILS
• CVE-2007-2446 Exploit
• OSVDB-34699 Exploit

By sending a malformed TFTP request to the GE D20ME, it is possible to crash the device. This module is based on the original 'd20ftpbo.rb' Basecamp module from DigitalBond.

• MODULE DETAILS
• http://www.digitalbond.com/to... Exploit

This is a proof of concept denial of service module for Sendmail versions 8.12.8 and earlier. The vulnerability is within the prescan() method when parsing SMTP headers. Due to the prescan function, only 0x5c and 0x00 bytes can be used, limiting the likelihood for arbitrary code execution.

• MODULE DETAILS
• OSVDB-2577 Exploit
• CVE-2003-0694 Exploit
• BID-8641 Exploit
• http://www.milw0rm.com/exploi... Exploit

This module performs a Denial of Service Attack against Datagram TLS in OpenSSL version 0.9.8i and earlier. OpenSSL crashes under these versions when it recieves a ChangeCipherspec Datagram before a ClientHello.

• MODULE DETAILS
• CVE-2009-1386 Exploit
• OSVDB-55073 Exploit

This module exploits a denial of service vulnerability in Juniper Network's JunOS router operating system. By sending a TCP packet with TCP option 101 set, an attacker can cause an affected router to reboot.

• MODULE DETAILS
• BID-37670 Exploit
• OSVDB-61538 Exploit
• http://praetorianprefect.com/... Exploit

The Apple Airport driver provided with Orinoco-based Airport cards (1999-2003 PowerBooks, iMacs) is vulnerable to a remote memory corruption flaw. When the driver is placed into active scanning mode, a malformed probe response frame can be used to corrupt internal kernel structures, leading to arbitrary code execution. This vulnerability is triggered when a probe response frame is received that does not contain valid information element (IE) fields after the fixed-length header. The data following the fixed-length header is copied over internal kernel structures, resulting in memory operations being performed on attacker-controlled pointer values.

• MODULE DETAILS
• CVE-2006-5710 Exploit
• OSVDB-30180 Exploit

This module sends 802.11 DEAUTH requests to a specific wireless peer, using the specified source address and source BSSID.

• MODULE DETAILS

Inspired by Josh Wright's file2air, this module writes wireless frames from a binary file to the air, allowing you to substitute some addresses before it gets sent. Unlike the original file2air (currently v1.1), this module *does* take into account the ToDS and FromDS flags in the frame when replacing any specified addresses.

• MODULE DETAILS

This module exploits a buffer overflow in the NetGear WG311v1 wireless device driver under Windows XP and 2000. A kernel-mode heap overflow occurs when malformed probe response frame is received that contains a long SSID field This DoS was tested with version 2.3.1.10 of the WG311ND5.SYS driver and a NetGear WG311v1 PCI card. A remote code execution module is also in development. This module depends on the Lorcon2 library and only works on the Linux platform with a supported wireless card. Please see the Ruby Lorcon2 documentation (external/ruby-lorcon/README) for more information.

• MODULE DETAILS
• CVE-2006-6125 Exploit
• OSVDB-30511 Exploit
• http://projects.info-pull.com... Exploit
• ftp://downloads.netgear.com/f... Exploit

This module sends out beacon frames using SSID's identified in a specified file and randomly selected BSSID's. This is useful when combined with a Karmetasploit attack to get clients configured to not probe for networks in their PNL to start probing when they see a matching SSID in from this script. For a list of common SSID's to use with this script, check http://www.wigle.net/gps/gps/main/ssidstats. If a file of SSID's is not specified, a default list of 20 SSID's will be used. This script will run indefinitely until interrupted.

• MODULE DETAILS

This module exploits a denial of service flaw in the Appian Enterprise Business Suite service.

• MODULE DETAILS
• CVE-2007-6509 Exploit
• OSVDB-39500 Exploit
• http://archives.neohapsis.com... Exploit

This module triggers a Denial of Service condition in the FileZilla FTP Server Administration Interface in versions 0.9.4d and earlier. By sending a procession of excessively long USER commands to the FTP Server, the Administration Interface (FileZilla Server Interface.exe) when running, will overwrite the stack with our string and generate an exception. The FileZilla FTP Server itself will continue functioning.

• MODULE DETAILS
• BID-15346 Exploit
• CVE-2005-3589 Exploit
• http://www.milw0rm.com/exploi... Exploit
• OSVDB-20817 Exploit

Guild FTPd 0.999.8.11 and 0.999.14 are vulnerable to heap corruption. You need to have a valid login so you can run CWD and LIST.

• MODULE DETAILS
• CVE-2008-4572 Exploit
• OSVDB-49045 Exploit
• http://milw0rm.com/exploits/6738 Exploit

This module triggers Denial of Service condition in the Microsoft Internet Information Services (IIS) FTP Server 5.0 through 7.0 via a list (ls) -R command containing a wildcard. For this exploit to work in most cases, you need 1) a valid ftp account: either read-only or write-access account 2) the "FTP Publishing" must be configured as "manual" mode in startup type 3) there must be at least one directory under FTP root directory. If your provided an FTP account has write-access privilege and there is no single directory, a new directory with random name will be created prior to sending exploit payload.

• MODULE DETAILS
• CVE-2009-2521 Exploit
• BID-36273 Exploit
• OSVDB-57753 Exploit
• MSB-MS09-053 Exploit
• https://www.microsoft.com/tec... Exploit
• http://archives.neohapsis.com... Exploit

The Titan FTP server v6.26 build 630 can be DoS'd by issuing "SITE WHO". You need a valid login so you can send this command.

• MODULE DETAILS
• CVE-2008-6082 Exploit
• OSVDB-49177 Exploit
• http://milw0rm.com/exploits/6753 Exploit

This module is a very rough port of Julien Bedard's PoC. You need a valid login, but even anonymous can do it if it has permission to call NLST.

• MODULE DETAILS
• CVE-2008-5666 Exploit
• OSVDB-49043 Exploit
• http://milw0rm.com/exploits/6581 Exploit

You need a valid login to DoS this FTP server, but even anonymous can do it as long as it has permission to call NLST.

• MODULE DETAILS
• CVE-2008-5626 Exploit
• OSVDB-50837 Exploit
• http://milw0rm.com/exploits/8294 Exploit

The vulnerability allows remote unauthenticated attackers to force the IIS server to become unresponsive until the IIS service is restarted manually by the administrator. Required is that Active Server Pages are hosted by the IIS and that an ASP script reads out a Post Form value.

• MODULE DETAILS
• CVE-2010-1899 Exploit
• OSVDB-67978 Exploit
• MSB-MS10-065 Exploit
• EDB-15167 Exploit

This module exploits a buffer underrun vulnerability in Microsoft's DNSAPI.dll as distributed with Windows Vista and later without KB2509553. By sending a specially crafted LLMNR query, containing a leading '.' character, an attacker can trigger stack exhaustion or potentially cause stack memory corruption. Although this vulnerability may lead to code execution, it has not been proven to be possible at the time of this writing. NOTE: In some circumstances, a '.' may be found before the top of the stack is reached. In these cases, this module may not be able to cause a crash.

• MODULE DETAILS
• CVE-2011-0657 Exploit
• OSVDB-71780 Exploit
• MSB-MS11-030 Exploit

This module exploits the MS12-020 RDP vulnerability originally discovered and reported by Luigi Auriemma. The flaw can be found in the way the T.125 ConnectMCSPDU packet is handled in the maxChannelIDs field, which will result an invalid pointer being used, therefore causing a denial-of-service condition.

• MODULE DETAILS
• CVE-2012-0002 Exploit
• MSB-MS12-020 Exploit
• http://www.privatepaste.com/f... Exploit
• http://pastie.org/private/4eg... Exploit
• http://pastie.org/private/feg... Exploit
• http://stratsec.blogspot.com.... Exploit
• EDB-18606 Exploit

This module triggers a kernel pool corruption bug in SRV.SYS. Each call to the mailslot write function results in a two byte return value being written into the response packet. The code which creates this packet fails to consider these two bytes in the allocation routine, resulting in a slow corruption of the kernel memory pool. These two bytes are almost always set to "\xff\xff" (a short integer with value of -1).

• MODULE DETAILS
• BID-19215 Exploit
• OSVDB-27644 Exploit
• CVE-2006-3942 Exploit
• http://www.coresecurity.com/c... Exploit
• MSB-MS06-035 Exploit

This module exploits a denial of service vulnerability in the SRV.SYS driver of the Windows operating system. This module has been tested successfully against Windows Vista.

• MODULE DETAILS
• MSB-MS09-001 Exploit
• OSVDB-48153 Exploit
• CVE-2008-4114 Exploit
• BID-31179 Exploit

This module triggers a NULL pointer dereference in the SRV2.SYS kernel driver when processing an SMB2 logoff request before a session has been correctly negotiated, resulting in a BSOD. Effecting Vista SP1/SP2 (And possibly Server 2008 SP1/SP2), the flaw was resolved with MS09-050.

• MODULE DETAILS
• CVE-2009-3103 Exploit
• OSVDB-57799 Exploit
• MSB-MS09-050 Exploit

This module exploits a denial of service flaw in the Microsoft Windows SMB service on versions of Windows prior to the August 2010 Patch Tuesday. To trigger this bug, you must be able to access a share with at least read privileges. That generally means you will need authentication. However, if a system has a guest accessible share, you can trigger it without any authentication.

• MODULE DETAILS
• CVE-2010-2550 Exploit
• OSVDB-66974 Exploit
• MSB-MS10-054 Exploit
• http://seclists.org/fulldiscl... Exploit

This module triggers a NULL dereference in svchost.exe on all current versions of Windows that run the RRAS service. This service is only accessible without authentication on Windows XP SP1 (using the SRVSVC pipe).

• MODULE DETAILS
• OSVDB-64340 Exploit

This module triggers a heap overflow vulnerability in MS Exchange that occurs when multiple malformed MODPROP values occur in a VCAL request.

• MODULE DETAILS
• BID-17908 Exploit
• CVE-2006-0027 Exploit
• MSB-MS06-019 Exploit

The SolarWinds TFTP server can be shut down by sending a 'netascii' read request with a specially crafted file name.

• MODULE DETAILS
• CVE-2010-2115 Exploit
• OSVDB-64845 Exploit
• EDB-12683 Exploit

This module causes infinite recursion to occur within the CLDAP dissector by sending a specially crafted UDP packet.

• MODULE DETAILS
• CVE-2011-1140 Exploit
• OSVDB-71552 Exploit
• http://www.wireshark.org/secu... Exploit
• https://bugs.wireshark.org/bu... Exploit

This module will connect to a DNS server and perform DNS and DNSSEC protocol-level fuzzing. Note that this module may inadvertently crash the target server.

• MODULE DETAILS

This module will connect to a FTP server and perform pre- and post-authentication fuzzing

• MODULE DETAILS

This module sends a series of HTTP GET request with incrementing URL lengths.

• MODULE DETAILS

This module sends a series of SMB negiotiate requests that advertise a SMB2 dialect with corrupted bytes.

• MODULE DETAILS

This module sends a series of SMB create pipe requests with corrupted bytes.

• MODULE DETAILS

This module sends a series of SMB login requests using the NTLMv1 protocol with corrupted bytes.

• MODULE DETAILS

This module sends a series of SMB tree connect requests with corrupted bytes.

• MODULE DETAILS

This module sends a series of SSH requests with a corrupted initial key exchange payload.

• MODULE DETAILS

This module sends a series of SSH requests with malicious version strings.

• MODULE DETAILS

This module sends a series of malformed TDS login requests.

• MODULE DETAILS

This module sends out corrupted beacon frames.

• MODULE DETAILS

This module exploits a cross-domain issue within the Android web browser to exfiltrate files from a vulnerable device.

• MODULE DETAILS

This module attempts to query Citrix Metaframe ICA server to obtain a published list of applications.

• MODULE DETAILS
• http://www.securiteam.com/exp... Exploit

This module interfaces with the CorpWatch API to get publicly available info for a given CorpWatch ID of the company. If you don't know the CorpWatch ID, please use the corpwatch_lookup_name module first.

• MODULE DETAILS
• http://api.corpwatch.org/ Exploit

The General Electric D20ME and possibly other units (D200?) feature TFTP readable configurations with plaintext passwords. This module retrieves the username, password, and authentication level list.

• MODULE DETAILS

Scan NAT devices for their external address using NAT-PMP

• MODULE DETAILS

This module uses the SHODAN API to query the database and returns the first 50 IPs. SHODAN accounts are free & output can be sent to a file for use by another program. Results can also populated into the services table in the database. NOTE: SHODAN filters (port, hostname, os, geo, city) can be used in queries, but the free API does not allow net, country, before, and after filters. An unlimited API key can be purchased from the Shodan site to use those queries. The 50 result limit can also be raised to 10,000 for a small fee. API: http://www.shodanhq.com/api_doc FILTERS: http://www.shodanhq.com/help/filters

• MODULE DETAILS

This module attempts to bruteforce authentication credentials for AFP.

• MODULE DETAILS
• https://developer.apple.com/l... Exploit
• https://developer.apple.com/l... Exploit

Detect instances of the Energizer DUO trojan horse software on port 7777

• MODULE DETAILS
• CVE-2010-0103 Exploit
• OSVDB-62782 Exploit
• US-CERT-VU-154421 Exploit

This module queries a DB2 instance information.

• MODULE DETAILS

This module can be used to obtain information from the Endpoint Mapper service.

• MODULE DETAILS

This module can be used to obtain information from the Remote Management Interface DCERPC service.

• MODULE DETAILS

This module scans for active DECT calls

• MODULE DETAILS
• http://www.dedected.org Exploit

Enumerate alive Hosts in local network using ARP requests.

• MODULE DETAILS

Enumerate local IPv6 hosts which respond to Neighbor Solicitations with a link-local address. Note, that like ARP scanning, this usually cannot be performed beyond the local broadcast network.

• MODULE DETAILS

Detect common UDP services using sequential probes

• MODULE DETAILS

This module queries the remote host for the EMC Alphastor Device Management Service.

• MODULE DETAILS

Identify valid users through the finger service using a variety of tricks

• MODULE DETAILS

This module will test FTP logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

• MODULE DETAILS
• CVE-1999-0502 Exploit

Detect H.323 Version.

• MODULE DETAILS

Apache with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.

• MODULE DETAILS
• BID-3335 Exploit
• CVE-2001-1013 Exploit
• OSVDB-637 Exploit

This module attempts to login to an Apache Axis2 v1.4.1 instance using username and password combindations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options.

• MODULE DETAILS
• CVE-2010-0219 Exploit
• OSVDB-68662 Exploit

This module exploits a directory traversal vulnerability present in serveral Barracuda products, including the Barracuda Spam and Virus Firewall, Barracuda SSL VPN, and the Barracuda Web Application Firewall. By default, this module will attempt to download the Barracuda configuration file.

• MODULE DETAILS
• OSVDB-68301 Exploit
• http://secunia.com/advisories... Exploit
• EDB-15130 Exploit

This module identifies the existence of interesting directories by brute forcing the name in a given directory path.

• MODULE DETAILS

This module gathers data from a Cisco device (router or switch) with the device manager web interface exposed. The BasicAuthUser and BasicAuthPass options can be used to specify authentication.

• MODULE DETAILS
• BID-1846 Exploit
• CVE-2000-0945 Exploit
• OSVDB-444 Exploit

This module tests whether a directory traversal vulnerablity is present in versions of Cisco Network Access Manager 4.8.x You may wish to change FILE (e.g. passwd or hosts), MAXDIRS and RPORT depending on your environment.

• MODULE DETAILS
• CVE-2011-3305 Exploit
• OSVDB-76080 Exploit
• http://www.cisco.com/warp/pub... Exploit
• http://dev.metasploit.com/red... Exploit

This module attempts to exploit the directory traversal in the 'locale' attribute. According to the advisory the following versions are vulnerable: ColdFusion MX6 6.1 base patches, ColdFusion MX7 7,0,0,91690 base patches, ColdFusion MX8 8,0,1,195765 base patches, ColdFusion MX8 8,0,1,195765 with Hotfix4. Adobe released patches for ColdFusion 8.0, 8.0.1, and 9 but ColdFusion 9 is reported to have directory traversal protections in place, subsequently this module does NOT work against ColdFusion 9. Adobe did not release patches for ColdFusion 6.1 or ColdFusion 7.

• MODULE DETAILS
• CVE-2010-2861 Exploit
• BID-42342 Exploit
• OSVDB-67047 Exploit
• http://www.procheckup.com/vul... Exploit
• http://www.gnucitizen.org/blo... Exploit
• http://www.adobe.com/support/... Exploit

Crawl a web site and store information about what was found

• MODULE DETAILS

This module identifies the existence of interesting directories in a given directory path.

• MODULE DETAILS

This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface, and should only work against version 3.1.1 or older, because these versions do not have any default protections against bruteforcing.

• MODULE DETAILS

Ektron CMS400.NET is a web content management system based on .NET. This module tests for installations that are utilizing default passwords set by the vendor. Additionally, it has the ability to brute force user accounts. Note that Ektron CMS400.NET, by default, enforces account lockouts for regular user account after a number of failed attempts.

• MODULE DETAILS

This module pulls and parses the URLs stored by Archive.org for the purpose of replaying during a web assessment. Finding unlinked and old pages.

• MODULE DETAILS

This module identifies the existence of files in a given directory path named as the same name of the directory. Only works if PATH is differenet than '/'.

• MODULE DETAILS

This module queries the FrontPage Server Extensions and determines whether anonymous access is allowed.

• MODULE DETAILS
• http://en.wikipedia.org/wiki/... Exploit
• http://msdn2.microsoft.com/en... Exploit

This module attempts to authenticate to an HTTP service.

• MODULE DETAILS
• CVE-1999-0502 Exploit

This module allows you to test if a web server (or web application) is vulnerable to directory traversal with three different actions. The 'CHECK' action (default) is used to automatically (or manually) find if directory traversal exists in the web server, and then return the path that triggers the vulnerability. The 'DOWNLOAD' action shares the same ability as 'CHECK', but will take advantage of the found trigger to download files based on a 'FILELIST' of your choosing. The 'WRITABLE' action can be used to determine if the trigger can be used to write files outside the www directory. To use the 'COOKIE' option, set your value like so: "name=value". To use the 'BASICAUTH' option, set it like this: "username:password".

• MODULE DETAILS

This module can be used to enumerate information about an IP addresses from Project HoneyPot's HTTP Block List.

• MODULE DETAILS
• http://www.projecthoneypot.or... Exploit

This module request a copy of the remote SSL certificate and creates a local (self.signed) version using the information from the remote version. The module then Outputs (PEM|DER) format private key / certificate and a combined version for use in Apache or other Metasploit modules requiring SSLCert Inputs for private key / CA cert have been provided for those with diginator certs hanging about!

• MODULE DETAILS

This module exploits a source code disclosure/download vulnerability in versions 4.0.14 and prior of LiteSpeed.

• MODULE DETAILS
• CVE-2010-2333 Exploit
• OSVDB-65476 Exploit
• BID-40815 Exploit
• EDB-13850 Exploit

This module exploits a directory traversal vulnerability present in the _list_file_get() function of Majordomo2 (help function). By default, this module will attempt to download the Majordomo config.pl file.

• MODULE DETAILS
• OSVDB-70762 Exploit
• CVE-2011-0049 Exploit
• CVE-2011-0063 Exploit
• https://sitewat.ch/en/Advisor... Exploit
• http://sotiriu.de/adv/NSOADV-... Exploit
• EDB-16103 Exploit

This module performs a brute force attack in order to discover existing files on a server which uses mod_negotiation. If the filename is found, the IP address and the files found will be displayed.

• MODULE DETAILS

Simplified version of MS09-020 IIS6 WebDAV Unicode Auth Bypass scanner. It attempts to bypass authentication using the WebDAV IIS6 Unicode vulnerability discovered by Kingcope. The vulnerability appears to be exploitable where WebDAV is enabled on the IIS6 server, and any protected folder requires either Basic, Digest or NTLM authentication.

• MODULE DETAILS
• MSB-MS09-020 Exploit
• CVE-2009-1535 Exploit
• CVE-2009-1122 Exploit
• OSVDB-54555 Exploit
• BID-34993 Exploit

This module exploits a source code disclosure/download vulnerability in versions 0.7 and 0.8 of the nginx web server. Versions 0.7.66 and 0.8.40 correct this vulnerability.

• MODULE DETAILS
• CVE-2010-2263 Exploit
• OSVDB-65531 Exploit
• BID-40760 Exploit
• EDB-13818 Exploit
• EDB-13822 Exploit

Display available HTTP options for each system

• MODULE DETAILS
• CVE-2005-3398 Exploit
• CVE-2005-3498 Exploit
• OSVDB-877 Exploit
• BID-11604 Exploit
• BID-9506 Exploit
• BID-9561 Exploit

This module identifies files in the first parent directory with same name as the given directory path. Example: Test /backup/files/ will look for the following files /backup/files.ext .

• MODULE DETAILS

This module identifies the existence of additional files by modifying the extension of an existing file.

• MODULE DETAILS

Detect robots.txt files and analize its content

• MODULE DETAILS

This module simply attempts to bruteforce SAP BusinessObjects users by using CmcApp.

• MODULE DETAILS
• http://spl0it.org/files/talks... Exploit

This module simply attempts to identify the version of SAP BusinessObjects.

• MODULE DETAILS
• http://spl0it.org/files/talks... Exploit

This module attempts to brute force SOAP/XML requests to uncover hidden methods.

• MODULE DETAILS

This module launch a sqlmap session. sqlmap is an automatic SQL injection tool developed in Python. Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user specific DBMS tables/columns, run his own SQL SELECT statement, read specific files on the file system and much more.

• MODULE DETAILS
• http://sqlmap.sourceforge.net Exploit

This module attempts to enumernate remote users that exist within the Squiz Matrix and MySource Matrix CMS by sending GET requests for asset IDs e.g. ?a=14 and searching for a valid username eg "~root" or "~test" which is prefixed by a "~" in the response. It will also try to GET the users full name or description, or other information. You may wish to modify ASSETBEGIN and ASSETEND values for greater results, or set VERBOSE. Information gathered may be used for later bruteforce attacks.

• MODULE DETAILS
• http://www.osisecurity.com.au... Exploit

Detect subversion directories and files and analize its content. Only SVN Version > 7 supported

• MODULE DETAILS

Apache Tomcat user enumeration utility, for Apache Tomcat servers prior to version 6.0.20, 5.5.28, and 4.1.40.

• MODULE DETAILS
• BID-35196 Exploit
• CVE-2009-0580 Exploit
• OSVDB-55055 Exploit

Test if TRACE is actually enabled. 405 (Apache) 501(IIS) if its disabled, 200 if it is

• MODULE DETAILS

This module attempts to authenticate to an English-based V-CMS login interface. It should only work against version v1.1 or older, because these versions do not have any default protections against bruteforcing.

• MODULE DETAILS

This module tries to identify unique virtual hosts hosted by the target web server.

• MODULE DETAILS

This modules exploits a directory traversal vulnerability in VMWare Update Manager on port 9084. Versions affected by this vulnerability: vCenter Update Manager 4.1 prior to Update 2, vCenter Update Manager 4 Update 4.

• MODULE DETAILS
• CVE-2011-4404 Exploit
• EDB-18138 Exploit
• http://www.vmware.com/securit... Exploit
• http://dsecrg.com/pages/vul/s... Exploit

Detect webservers internal IPs though WebDAV

• MODULE DETAILS

Detect webservers disclosing its content though WebDAV

• MODULE DETAILS

This module exploits blind XPATH 1.0 injections over HTTP GET requests.

• MODULE DETAILS

IMAP4 Banner Grabber

• MODULE DETAILS

Get users passwords hashes from names.nsf page

• MODULE DETAILS

Several checks to determine Lotus Domino Server Version.

• MODULE DETAILS

This module retrieves version of the services manager, version and implementation of the InterBase server from InterBase Services Manager.

• MODULE DETAILS

This module scans for OKI printers via SNMP, then tries to connect to found devices with vendor default administrator credentials via HTTP authentication. By default, OKI network printers use the last six digits of the MAC as admin password.

• MODULE DETAILS

This module takes advantage of a protocol design issue with the Rosewill admin executable in order to retrieve passwords, allowing remote attackers to take administrative control over the device. Other similar IP Cameras such as Edimax, Hawking, Zonet, etc, are also believed to have the same flaw, but not fully tested. The protocol deisgn issue also allows attackers to reset passwords on the device.

• MODULE DETAILS
• http://spareclockcycles.org/e... Exploit

This module attempts to brute force authentication credentials for MongoDB. Note that, by default, MongoDB does not require authentication.

• MODULE DETAILS
• http://www.mongodb.org/displa... Exploit
• http://www.mongodb.org/displa... Exploit

This module extracts the usernames and encrypted password hashes from a MSSQL server and stores them for later cracking. This module also saves information about the server version and table names, which can be used to seed the wordlist.

• MODULE DETAILS

This module simply queries the MSSQL instance for information.

• MODULE DETAILS

This module extracts the usernames and encrypted password hashes from a MySQL server and stores them for later cracking.

• MODULE DETAILS

This module extracts the schema information from a MySQL DB server.

• MODULE DETAILS

Scan NAT devices for their external listening ports using NAT-PMP

• MODULE DETAILS

Discover host information using sequential NetBIOS Probes

• MODULE DETAILS

Obtain the list of recent clients from an NTP server

• MODULE DETAILS

This module attempts to authenticate against an Oracle ISQL*Plus administration web site using username and password combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE. This module does not require a valid SID, but if one is defined, it will be used. Works against Oracle 9.2, 10.1 & 10.2 iSQL*Plus. This module will attempt to fingerprint the version and automatically select the correct POST request.

• MODULE DETAILS
• http://carnal0wnage.attackres... Exploit

This module dumps the usernames and password hashes from Oracle given the proper Credentials and SID. These are then stored as loot for later cracking.

• MODULE DETAILS

This module queries the TNS listner for a valid Oracle database instance name (also known as a SID). Any response other than a "reject" will be considered a success. If a specific SID is provided, that SID will be attempted. Otherwise, SIDs read from the named file will be attempted in sequence instead.

• MODULE DETAILS

This module makes a request to the Oracle Application Server in an attempt to discover the SID.

• MODULE DETAILS
• http://dsecrg.com/files/pub/p... Exploit

This module simply makes a authenticated request to retrieve the sid from the Oracle XML DB httpd server.

• MODULE DETAILS
• http://dsecrg.com/files/pub/p... Exploit

Discover active pcAnywhere services through TCP

• MODULE DETAILS

This module attempts to authenticate to an POP3 service.

• MODULE DETAILS
• http://www.ietf.org/rfc/rfc17... Exploit
• http://www.ietf.org/rfc/rfc19... Exploit

Map out firewall rulesets with a raw ACK scan. Any unfiltered ports found means a stateful firewall is not in place for them.

• MODULE DETAILS

Enumerate open TCP services using a raw SYN scan.

• MODULE DETAILS

Enumerate open|filtered TCP services using a raw "XMas" scan; this sends probes containing the FIN, PSH and URG flags.

• MODULE DETAILS

This module attempts to authenticate against a PostgreSQL instance using username and password combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options.

• MODULE DETAILS
• http://www.postgresql.org Exploit
• CVE-1999-0502 Exploit

Enumerates the verion of PostgreSQL servers.

• MODULE DETAILS
• http://www.postgresql.org Exploit

This module send a series of TCP SYN and ICMP ECHO requests to each internal target host, spoofing the source address of an external system running the rogue_recv module. This allows the system running the rogue_recv module to determine what external IP a given internal system is using as its default route.

• MODULE DETAILS
• http://www.metasploit.com/res... Exploit

This module will test an rlogin service on a range of machines and report successful logins. NOTE: This module requires access to bind to privileged ports (below 1024).

• MODULE DETAILS
• CVE-1999-0651 Exploit
• CVE-1999-0502 Exploit

This module scans for commonly found SAP Internet Communication Manager URLs and outputs return codes for the user.

• MODULE DETAILS
• CVE-2010-0738 Exploit

This module simply attempts to brute force the username | password for the SAP Management Console SOAP Interface. By setting the SAP SID value, a list of default SAP users can be tested without needing to set a USERNAME or USER_FILE value. The default usernames are stored in ./data/wordlists/sap_common.txt (the value of SAP SID is automatically inserted into the username to replce <SAPSID>).

• MODULE DETAILS
• http://blog.c22.cc Exploit

This module simply attempts to output a list of SAP access points through the SAP Management Console SOAP Interface.

• MODULE DETAILS
• http://blog.c22.cc Exploit

This module simply attempts to download available logfiles and developer tracefiles through the SAP Management Console SOAP Interface. Please use the sap_manamgenet_console_listlogfiles extension to view a list of availble files.

• MODULE DETAILS
• http://blog.c22.cc Exploit

This module simply attempts to identify the instance properties through the SAP Management Console SOAP Interface.

• MODULE DETAILS
• http://blog.c22.cc Exploit

This module simply attempts to acces the SAP startup profile through the SAP Management Console SOAP Interface.

• MODULE DETAILS
• http://blog.c22.cc Exploit

Scans for listening SAP services.

• MODULE DETAILS
• http://blog.c22.cc Exploit

Scan for numeric username/extensions using OPTIONS/REGISTER requests

• MODULE DETAILS

Scan for SIP devices using OPTIONS requests

• MODULE DETAILS

This module exploits a leak of extension/SIP Gateway on SIPDroid 1.6.1 beta, 2.0.1 beta, 2.2 beta (tested in Android 2.1 and 2.2 - official Motorola release) (other versions may be affected).

• MODULE DETAILS
• BID-47710 Exploit
• http://seclists.org/fulldiscl... Exploit

Determine what DCERPC services are accessible over a SMB pipe

• MODULE DETAILS

Determine what shares are provided by the SMB service

• MODULE DETAILS

Determine what domain users are logged into a remote system via a DCERPC to NetWkstaUserEnum.

• MODULE DETAILS
• http://msdn.microsoft.com/en-... Exploit

Determine what local users exist via brute force SID lookups

• MODULE DETAILS

The SMTP service has two internal commands that allow the enumeration of users: VRFY (confirming the names of valid users) and EXPN (which reveals the actual address of users aliases and lists of e-mail (mailing lists)). Through the implementation of these SMTP commands can reveal a list of valid users.

• MODULE DETAILS
• http://www.ietf.org/rfc/rfc28... Exploit
• OSVDB-12551 Exploit
• CVE-1999-0531 Exploit

AIX SNMP Scanner Auxiliary Module

• MODULE DETAILS

This module will copy file to a Cisco IOS device using SNMP and TFTP. A read-write SNMP community is required. The SNMP community scanner module can assist in identifying a read-write community. The target must be able to connect back to the Metasploit system and the use of NAT will cause the TFTP transfer to fail.

• MODULE DETAILS

This module will use LanManager OID values to enumerate SMB shares on a Windows system via SNMP

• MODULE DETAILS

Scan for SNMP devices using common community names

• MODULE DETAILS
• CVE-1999-0508 Exploit

This module will do user enumeration based on the Xerox WorkCentre present on the network. SNMP is used to extract the usernames.

• MODULE DETAILS

This module will test ssh logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

• MODULE DETAILS
• CVE-1999-0502 Exploit

Detect SSH Version.

• MODULE DETAILS
• http://en.wikipedia.org/wiki/... Exploit

Detect Lantronix telnet services

• MODULE DETAILS

This module will test a telnet login on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

• MODULE DETAILS
• CVE-1999-0502 Exploit

Detect telnet services

• MODULE DETAILS

This module uses a dictionary to brute force valid TFTP image names from a TFTP server.

• MODULE DETAILS

This module accesses the web API interfaces for VMware ESX/ESXi servers and attempts to identify version information for that server.

• MODULE DETAILS

This module will identify information about a host through the vmauthd service.

• MODULE DETAILS

This module will log into the Web API of VMWare and try to enumerate all the login sessions.

• MODULE DETAILS

This module attempts to discover virtual machines on any VMWare instance running the web interface. This would include ESX/ESXi and VMWare Server.

• MODULE DETAILS

This module attempts to authenticate to the VMWare HTTP service for VmWare Server, ESX, and ESXI

• MODULE DETAILS
• CVE-1999-0502 Exploit

This module will test a VNC server on a range of machines and report successful logins. Currently it supports RFB protocol version 3.3, 3.7, and 3.8 using the VNC challenge response authentication method.

• MODULE DETAILS
• CVE-1999-0506 Exploit

This module dials a range of phone numbers and records audio from each answered call

• MODULE DETAILS

Scan for exposed VxWorks wdbrpc daemons

• MODULE DETAILS
• http://blog.metasploit.com/20... Exploit
• http://www.kb.cert.org/vuls/i... Exploit

This module has three actions. The first (and the default) is 'WebServer' which uses a combination of client-side and server-side techniques to fingerprint HTTP clients and then automatically exploit them. Next is 'DefangedDetection' which does only the fingerprinting part. Lastly, 'list' simply prints the names of all exploit modules that would be used by the WebServer action given the current MATCH and EXCLUDE options. Also adds a 'list' command which is the same as running with ACTION=list.

• MODULE DETAILS

This module provides a fake HTTP service that is designed to capture authentication credentials.

• MODULE DETAILS

This module attempts to quietly catch NTLM/LM Challenge hashes.

• MODULE DETAILS

This module provides a fake POP3 service that is designed to capture authentication credentials.

• MODULE DETAILS

This module provides a fake SMTP service that is designed to capture authentication credentials.

• MODULE DETAILS

This module provides a DHCP service

• MODULE DETAILS

This module provides a DNS service that redirects all queries to a particular address.

• MODULE DETAILS

This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid 0 user with username and password metasploit to any linux partition seen. The windows user will have the password p@SSw0rd!123456 (in case of complexity requirements) and will be added to the administrators group. Note: the displayed IP address of a target is the address this DHCP server handed out, not the "normal" IP address the host uses.

• MODULE DETAILS

This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path.

• MODULE DETAILS

This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\

• MODULE DETAILS

Spoof ARP replies and poison remote ARP caches to conduct IP address spoofing or a denial of service.

• MODULE DETAILS
• OSVDB-11169 Exploit
• CVE-1999-0667 Exploit
• http://en.wikipedia.org/wiki/... Exploit

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed ~Jul 2008. This exploit replaces the target domains nameserver entries in a vulnerable DNS cache server. This attack works by sending random hostname queries to the target DNS server coupled with spoofed replies to those queries from the authoritative nameservers for that domain. Eventually, a guessed ID will match, the spoofed packet will get accepted, and the nameserver entries for the target domain will be replaced by the server specified in the NEWDNS option of this exploit.

• MODULE DETAILS
• CVE-2008-1447 Exploit
• OSVDB-46776 Exploit
• US-CERT-VU-800113 Exploit
• http://www.caughq.org/exploit... Exploit

This module can be used to determine differences in the cache entries between two DNS servers. This is primarily useful for detecting cache poisoning attacks, but can also be used to detect geo-location loadbalancing.

• MODULE DETAILS

replay a pcap capture file

• MODULE DETAILS

Race DNS responses and replace DNS queries

• MODULE DETAILS

The module exploits an sql injection flaw in the ALTER_AUTOLOG_CHANGE_SOURCE procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTE_CATALOG_ROLE have the required privilege. Affected versions: Oracle Database Server versions 10gR1, 10gR2 and 11gR1. Fixed with October 2008 CPU.

• MODULE DETAILS
• CVE-2008-3995 Exploit
• OSVDB-49320 Exploit
• http://www.appsecinc.com/reso... Exploit

The module exploits an sql injection flaw in the CREATE_CHANGE_SET procedure of the PL/SQL package DBMS_CDC_PUBLISH. Any user with execute privilege on the vulnerable package can exploit this vulnerability. By default, users granted EXECUTE_CATALOG_ROLE have the required privilege.

• MODULE DETAILS
• CVE-2010-2415 Exploit
• OSVDB-70078 Exploit
• http://www.oracle.com/technet... Exploit

This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in the DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_METADATA package. Note: This module has been tested against 9i, 10gR1 and 10gR2.

• MODULE DETAILS
• CVE-2006-2081 Exploit
• OSVDB-25002 Exploit
• BID-17699 Exploit
• http://www.red-database-secur... Exploit

This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in the SYS.DBMS_METADATA.GET_XML package/function.

• MODULE DETAILS
• http://www.metasploit.com Exploit

This module will escalate a Oracle DB user to MDSYS by exploiting an sql injection bug in the MDSYS.SDO_TOPO_DROP_FTBL trigger. After that exploit escalate user to DBA using "CREATE ANY TRIGGER" privilege given to MDSYS user by creating evil trigger in system scheme (2-stage attack).

• MODULE DETAILS
• CVE-2008-3979 Exploit
• OSVDB-51354 Exploit
• http://www.securityfocus.com/... Exploit
• http://www.ngssoftware.com/ Exploit

This module exploits a flaw (0 day) in DBMS_JVM_EXP_PERMS package that allows any user with create session privilege to grant themselves java IO privileges. Identified by David Litchfield. Works on 11g R1 and R2 (Windows only).

• MODULE DETAILS
• CVE-2010-0866 Exploit
• OSVDB-62184 Exploit
• http://blackhat.com/html/bh-d... Exploit
• http://www.notsosecure.com/fo... Exploit

This module will escalate a Oracle DB user to DBA by exploiting an sql injection bug in the SYS.LT.FINDRICSET package via Evil Cursor technique. Tested on oracle 10.1.0.3.0 -- should work on thru 10.1.0.5.0 and supposedly on 11g. Fixed with Oracle Critical Patch update October 2007.

• MODULE DETAILS
• CVE-2007-5511 Exploit
• OSVDB-40079 Exploit
• BID-26098 Exploit
• http://rawlab.mindcreations.c... Exploit
• http://www.oracle.com/technol... Exploit

This module exploits an sql injection flaw in the REMOVEWORKSPACE procedure of the PL/SQL package SYS.LT. Any user with execute privilege on the vulnerable package can exploit this vulnerability.

• MODULE DETAILS
• CVE-2008-3984 Exploit
• OSVDB-49326 Exploit
• http://www.appsecinc.com/reso... Exploit

This module attempts to authenticate to an Asterisk Manager service. Please note that by default, Asterisk Call Management (port 5038) only listens locally, but this can be manually configured in file /etc/asterisk/manager.conf by the admin on the victim machine.

• MODULE DETAILS
• http://www.asterisk.org/astdo... Exploit

This module queries known Mariposa Botnet DNS records.

• MODULE DETAILS
• http://www.defintel.com/docs/... Exploit

This module queries known Zeus Botnet DNS records.

• MODULE DETAILS
• https://zeustracker.abuse.ch/... Exploit

This module emulates a webserver leaking PII data

• MODULE DETAILS
• http://www.metasploit.com Exploit

This encoder uses standard Bourne shell variable substitution to avoid spaces without being overly fancy.

• MODULE DETAILS

This "encoder" does not transform the payload in any way.

• MODULE DETAILS

Mips Web server exploit friendly xor encoder

• MODULE DETAILS

This encoder is ghandi's PPC dword xor encoder with some size tweaks by HDM.

• MODULE DETAILS

This encoder is optyx's 48-byte SPARC encoder with some tweaks.

• MODULE DETAILS

Encodes payloads as alphanumeric mixedcase text. This encoder uses SkyLined's Alpha2 encoding suite.

• MODULE DETAILS

UTF8 Safe, tolower Safe Encoder

• MODULE DETAILS

This is a Context-Keyed Payload Encoder based on CPUID and Shikata Ga Nai.

• MODULE DETAILS

This is a Context-Keyed Payload Encoder based on time(2) and Shikata Ga Nai.

• MODULE DETAILS

This encoder uses a variable-length mov equivalent instruction with fnstenv for getip.

• MODULE DETAILS

Encodes payloads as non-alpha based bytes. This allows payloads to bypass both toupper() and tolower() calls, but will fail isalpha(). Table based design from Russel Sanford.

• MODULE DETAILS

This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically.

• MODULE DETAILS

Encodes payloads as unicode-safe mixedcase text. This encoder uses SkyLined's Alpha2 encoding suite.

• MODULE DETAILS

This module exploits a buffer overflow vulnerability in opcode 21 handled by rpc.cmsd on AIX. By making a request with a long string passed to the first argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This leads to arbitrary code execution. NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where further attempts are not possible.

• MODULE DETAILS
• CVE-2009-3699 Exploit
• OSVDB-58726 Exploit
• BID-36615 Exploit
• http://labs.idefense.com/inte... Exploit
• http://aix.software.ibm.com/a... Exploit

This is an exploit for an undisclosed buffer overflow in the SoftCart.exe CGI as shipped with Mercantec's shopping cart software. It is possible to execute arbitrary code by passing a malformed CGI parameter in an HTTP GET request. This issue is known to affect SoftCart version 4.00b.

• MODULE DETAILS
• CVE-2004-2221 Exploit
• OSVDB-9011 Exploit
• BID-10926 Exploit

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code.

• MODULE DETAILS
• CVE-2010-4221 Exploit
• OSVDB-68985 Exploit
• BID-44562 Exploit

This module exploits a stack buffer overflow in XTACACSD <= 4.1.2. By sending a specially crafted XTACACS packet with an overly long username, an attacker may be able to execute arbitrary code.

• MODULE DETAILS
• CVE-2008-7232 Exploit
• OSVDB-58140 Exploit
• http://aluigi.altervista.org/... Exploit

This exploit abuses an unpublished vulnerability in the HP-UX LPD service. This flaw allows an unauthenticated attacker to execute arbitrary commands with the privileges of the root user. The LPD service is only exploitable when the address of the attacking system can be resolved by the target. This vulnerability was silently patched with the buffer overflow flaws addressed in HP Security Bulletin HPSBUX0208-213.

• MODULE DETAILS
• CVE-2002-1473 Exploit
• OSVDB-9638 Exploit
• http://archives.neohapsis.com... Exploit

This module exploits a vulnerability in Adobe Flash Player for Linux, version 10.0.12.36 and 9.0.151.0 and prior. An input validation vulnerability allows command execution when the browser loads a SWF file which contains shell metacharacters in the arguments to the ActionScript launch method. The victim must have Adobe AIR installed for the exploit to work. This module was tested against version 10.0.12.36 (10r12_36).

• MODULE DETAILS
• CVE-2008-5499 Exploit
• OSVDB-50796 Exploit
• http://www.adobe.com/support/... Exploit
• http://www.securityfocus.com/... Exploit

This module exploits a stack-based buffer overflow in versions of ProFTPD server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a large number of Telnet IAC commands, an attacker can corrupt memory and execute arbitrary code. The Debian Squeeze version of the exploit uses a little ROP stub to indirectly transfer the flow of execution to a pool buffer (the cmd_rec "res" in "pr_cmd_read"). The Ubuntu version uses a ROP stager to mmap RWX memory, copy a small stub to it, and execute the stub. The stub then copies the remainder of the payload in and executes it. NOTE: Most Linux distributions either do not ship a vulnerable version of ProFTPD, or they ship a version compiled with stack smashing protection. Although SSP significantly reduces the probability of a single attempt succeeding, it will not prevent exploitation. Since the daemon forks in a default configuration, the cookie value will remain the same despite some attemtps failing. By making repeated requests, an attacker can eventually guess the cookie value and exploit the vulnerability. The cookie in Ubuntu has 24-bits of entropy. This reduces the effectiveness and could allow exploitation in semi-reasonable amount of time.

• MODULE DETAILS
• CVE-2010-4221 Exploit
• OSVDB-68985 Exploit
• BID-44562 Exploit

This module abuses a metacharacter injection vulnerability in the HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 and earlier. The Unified Maintenance Tool contains a 'masterCGI' binary which allows an unauthenticated attacker to execute arbitrary commands by specifing shell metacharaters as the 'user' within the 'ping' action to obtain 'httpd' user access. This module only supports command line payloads, as the httpd process kills the reverse/bind shell spawn after the HTTP 200 OK response.

• MODULE DETAILS
• OSVDB-40521 Exploit
• BID-25694 Exploit
• CVE-2007-3010 Exploit
• http://www1.alcatel-lucent.co... Exploit

This module exploits a vulnerability found in Dolibarr ERP/CRM's backup feature. This software is used to manage a company's business information such as contacts, invoices, orders, stocks, agenda, etc. When processing a database backup request, the export.php function does not check the input given to the sql_compat parameter, which allows a remote authenticated attacker to inject system commands into it, and then gain arbitrary code execution.

• MODULE DETAILS
• http://seclists.org/fulldiscl... Exploit

This module exploits a stack buffer overflow in apply.cgi on the Linksys WRT54G and WRT54GS routers. According to iDefense who discovered this vulnerability, all WRT54G versions prior to 4.20.7 and all WRT54GS version prior to 1.05.2 may be be affected.

• MODULE DETAILS
• CVE-2005-2799 Exploit
• OSVDB-19389 Exploit
• http://labs.idefense.com/inte... Exploit

This module abuses two flaws - a metacharacter injection vulnerability in the HTTP management server of RedHat 6.2 systems running the Piranha LVS cluster service and GUI (rpm packages: piranha and piranha-gui). The vulnerability allows an authenticated attacker to execute arbitrary commands as the Apache user account (nobody) within the /piranha/secure/passwd.php3 script. The package installs with a default user and password of piranha:q which was exploited in the wild.

• MODULE DETAILS
• CVE-2000-0248 Exploit
• OSVDB-289 Exploit
• BID-1148 Exploit
• CVE-2000-0322 Exploit
• OSVDB-1300 Exploit
• BID-1149 Exploit

This modules exploits a vulnerability found in k5n.us WebCalendar, version 1.2.4 or less. If not removed, the settings.php script meant for installation can be update by an attacker, and then inject code in it. This allows arbitrary code execution as www-data.

• MODULE DETAILS
• CVE-2012-1495 Exploit
• OSVDB-81329 Exploit
• EDB-18775 Exploit

This module exploits a buffer overflow in the 'LSUB' command of the University of Washington IMAP service. This vulnerability can only be exploited with a valid username and password.

• MODULE DETAILS
• CVE-2000-0284 Exploit
• OSVDB-12037 Exploit
• BID-1110 Exploit
• http://www.milw0rm.com/exploi... Exploit

This module exploits a chain of vulnerabilities in the Accellion File Transfer appliance. This appliance exposes a UDP service on port 8812 that acts as a gateway to the internal communication bus. This service uses Blowfish encryption for authentication, but the appliance ships with two easy to guess default authentication keys. This module abuses the known default encryption keys to inject a message into the communication bus. In order to execute arbitrary commands on the remote appliance, a message is injected into the bus destined for the 'matchrep' service. This service exposes a function named 'insert_plugin_meta_info' which is vulnerable to an input validation flaw in a call to system(). This provides access to the 'soggycat' user account, which has sudo privileges to run the primary admin tool as root. These two flaws are fixed in update version FTA_8_0_562.

• MODULE DETAILS
• OSVDB-71362 Exploit
• OSVDB-71363 Exploit
• http://www.rapid7.com/securit... Exploit

This module exploits a stack buffer overflow in the Salim Gasmi GLD <= 1.4 greylisting daemon for Postfix. By sending an overly long string the stack can be overwritten.

• MODULE DETAILS
• CVE-2005-1099 Exploit
• OSVDB-15492 Exploit
• BID-13129 Exploit
• http://www.milw0rm.com/exploi... Exploit

This module exploits a command execution vulnerable in the hpssd.py daemon of the Hewlett-Packard Linux Imaging and Printing Project. According to MITRE, versions 1.x and 2.x before 2.7.10 are vulnerable. This module was written and tested using the Fedora 6 Linux distribution. On the test system, the daemon listens on localhost only and runs with root privileges. Although the configuration shows the daemon is to listen on port 2207, it actually listens on a dynamic port. NOTE: If the target system does not have a 'sendmail' command installed, this vulnerability cannot be exploited.

• MODULE DETAILS
• CVE-2007-5208 Exploit
• OSVDB-41693 Exploit
• BID-26054 Exploit
• https://bugzilla.redhat.com/s... Exploit
• https://bugzilla.redhat.com/a... Exploit

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted create request.

• MODULE DETAILS
• CVE-2007-5243 Exploit
• OSVDB-38606 Exploit
• BID-25917 Exploit
• http://www.risesecurity.org/a... Exploit

This module exploits a stack buffer overflow in Borland InterBase by sending a specially crafted attach request.

• MODULE DETAILS
• CVE-2007-5243 Exploit
• OSVDB-38607 Exploit
• BID-25917 Exploit
• http://www.risesecurity.org/a... Exploit

This module exploits a buffer overflow in NetSupport Manager Agent. It uses a similar ROP to the proftpd_iac exploit in order to avoid non executable stack.

• MODULE DETAILS
• CVE-2011-0404 Exploit
• OSVDB-70408 Exploit
• BID-45728 Exploit
• http://seclists.org/fulldiscl... Exploit
• EDB-15937 Exploit

This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier) implementation bundled with MySQL <= 6.0. By sending a specially crafted Hello packet, an attacker may be able to execute arbitrary code.

• MODULE DETAILS
• CVE-2008-0226 Exploit
• OSVDB-41195 Exploit
• BID-27140 Exploit

This is an exploit for the Poptop negative read overflow. This will work against versions prior to 1.1.3-b3 and 1.1.3-20030409, but I currently do not have a good way to detect Poptop versions. The server will by default only allow 4 concurrent manager processes (what we run our code in), so you could have a max of 4 shells at once. Using the current method of exploitation, our socket will be closed before we have the ability to run code, preventing the use of Findsock.

• MODULE DETAILS
• CVE-2003-0213 Exploit
• OSVDB-3293 Exploit
• http://securityfocus.com/arch... Exploit
• http://www.freewebs.com/bligh... Exploit

This exploits a memory corruption vulnerability present in Samba versions prior to 3.3.13. When handling chained response packets, Samba fails to validate the offset value used when building the next part. By setting this value to a number larger than the destination buffer size, an attacker can corrupt memory. Additionally, setting this value to a value smaller than 'smb_wct' (0x24) will cause the header of the input buffer chunk to be corrupted. After close inspection, it appears that 3.0.x versions of Samba are not exploitable. Since they use an "InputBuffer" size of 0x20441, an attacker cannot cause memory to be corrupted in an exploitable way. It is possible to corrupt the heap header of the "InputBuffer", but it didn't seem possible to get the chunk to be processed again prior to process exit. In order to gain code execution, this exploit attempts to overwrite a "talloc chunk" destructor function pointer. This particular module is capable of exploiting the flaw on x86 Linux systems that do not have the nx memory protection. NOTE: It is possible to make exploitation attempts indefinitely since Samba forks for user sessions in the default configuration.

• MODULE DETAILS
• CVE-2010-2063 Exploit
• OSVDB-65518 Exploit
• http://labs.idefense.com/inte... Exploit

This exploits the buffer overflow found in Samba versions 2.2.0 to 2.2.8. This particular module is capable of exploiting the flaw on x86 Linux systems that do not have the noexec stack option set. NOTE: Some older versions of RedHat do not seem to be vulnerable since they apparently do not allow anonymous access to IPC.

• MODULE DETAILS
• CVE-2003-0201 Exploit
• OSVDB-4469 Exploit
• BID-7294 Exploit
• http://seclists.org/bugtraq/2... Exploit

This module exploits a memory corruption vulnerability in the Mozilla Firefox browser. This flaw occurs when a bug in the javascript interpreter fails to preserve the return value of the escape() function and results in uninitialized memory being used instead. This module has only been tested on Windows, but should work on other platforms as well with the current targets.

• MODULE DETAILS
• CVE-2009-2477 Exploit
• OSVDB-55846 Exploit
• BID-35660 Exploit
• https://bugzilla.mozilla.org/... Exploit

This exploit dynamically creates a .xpi addon file. The resulting bootstrapped Firefox addon is presented to the victim via a web page with. The victim's Firefox browser will pop a dialog asking if they trust the addon. Once the user clicks "install", the addon is installed and executes the payload with full user permissions. As of Firefox 4, this will work without a restart as the addon is marked to be "bootstrapped". As the addon will execute the payload after each Firefox restart, an option can be given to automatically uninstall the addon once the payload has been executed.

• MODULE DETAILS
• https://developer.mozilla.org... Exploit
• http://dvlabs.tippingpoint.co... Exploit

This module exploits a vulnerability due to the fact that AtomicReferenceArray uses the Unsafe class to store a reference in an array directly, which may violate type safety if not used properly. This allows a way to escape the JRE sandbox, and load additional classes in order to perform malicious operations.

• MODULE DETAILS
• CVE-2012-0507 Exploit
• OSVDB-80724 Exploit
• BID-52161 Exploit
• http://weblog.ikvm.net/PermaL... Exploit
• http://blogs.technet.com/b/mm... Exploit
• http://schierlm.users.sourcef... Exploit
• https://bugzilla.redhat.com/s... Exploit

This module exploits a flaw in the getSoundbank function in the Sun JVM. The payload is serialized and passed to the applet via PARAM tags. It must be a native payload. The effected Java versions are JDK and JRE 6 Update 16 and earlier, JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.2_23 and earlier, and SDK and JRE 1.3.1_26 and earlier. NOTE: Although all of the above versions are reportedly vulnerable, only 1.6.0_u11 and 1.6.0_u16 on Windows XP SP3 were tested.

• MODULE DETAILS
• CVE-2009-3867 Exploit
• OSVDB-59711 Exploit
• BID-36881 Exploit
• http://zerodayinitiative.com/... Exploit

This module exploits a vulnerability in the Java Runtime Environment that allows to deserialize a MarshalledObject containing a custom classloader under a privileged context. The vulnerability affects version 6 prior to update 19 and version 5 prior to update 23.

• MODULE DETAILS
• CVE-2010-0094 Exploit
• OSVDB-63484 Exploit
• http://slightlyrandombrokenth... Exploit

This exploit dynamically creates a .jar file via the Msf::Exploit::Java mixin, then signs the it. The resulting signed applet is presented to the victim via a web page with an applet tag. The victim's JVM will pop a dialog asking if they trust the signed applet. On older versions the dialog will display the value of CERTCN in the "Publisher" line. Newer JVMs display "UNKNOWN" when the signature is not trusted (i.e., it's not signed by a trusted CA). The SigningCert option allows you to provide a trusted code signing cert, the values in which will override CERTCN. If SigningCert is not given, a randomly generated self-signed cert will be used. Either way, once the user clicks "run", the applet executes with full user permissions.

• MODULE DETAILS
• http://www.defcon.org/images/... Exploit
• http://www.spikezilla-softwar... Exploit

This module exploits a code execution vulnerability in the Mozilla Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit module is a direct port of Aviv Raff's HTML PoC.

• MODULE DETAILS
• CVE-2005-2265 Exploit
• OSVDB-17968 Exploit
• BID-14242 Exploit
• http://www.mozilla.org/securi... Exploit

Opera web browser in versions <= 9.10 allows unrestricted script access to its configuration page, opera:config, allowing an attacker to change settings and potentially execute arbitrary code.

• MODULE DETAILS
• OSVDB-66472 Exploit

This module exploits an arbitrary memory access vulnerability in the Quicktime for Java API provided with Quicktime 7.

• MODULE DETAILS
• CVE-2007-2175 Exploit
• OSVDB-34178 Exploit
• BID-23608 Exploit
• http://www.zerodayinitiative.... Exploit

This module harnesses Maple's ability to create files and execute commands automatically when opening a Maplet. All versions up to 13 are suspected vulnerable. Testing was conducted with version 13 on Windows. Standard security settings prevent code from running in a normal maple worksheet without user interaction, but those setting do not prevent code in a Maplet from running. In order for the payload to be executed, an attacker must convince someone to open a specially modified .maplet file with Maple. By doing so, an attacker can execute arbitrary code as the victim user.

• MODULE DETAILS
• OSVDB-64541 Exploit
• http://www.maplesoft.com/prod... Exploit

This module exploits a format string vulnerability in versions of the Washington University FTP server older than 2.6.1. By executing specially crafted SITE EXEC or SITE INDEX commands containing format specifiers, an attacker can corrupt memory and execute arbitrary code.

• MODULE DETAILS
• CVE-2000-0573 Exploit
• OSVDB-11805 Exploit
• BID-1387 Exploit

This module exploits an arbitrary code injection vulnerability in the chat module that is part of Active Collab by abusing a preg_replace() using the /e modifier and its replacement string using double quotes. The vulnerable function can be found in activecollab/application/modules/chat/functions/html_to_text.php.

• MODULE DETAILS
• OSVDB-81966 Exploit
• http://www.activecollab.com/d... Exploit

This module logs in to an Axis2 Web Admin Module instance using a specific user/pass and uploads and executes commands via deploying a malicious web service by using SOAP.

• MODULE DETAILS
• http://www.rapid7.com/securit... Exploit
• http://spl0it.org/files/talks... Exploit
• CVE-2010-0219 Exploit

This module exploits an arbitrary command execution flaw in FreeNAS 0.7.2 < rev.5543. When passing a specially formatted URL to the exec_raw.php page, an attacker may be able to execute arbitrary commands. NOTE: This module works best with php/meterpreter payloads.

• MODULE DETAILS
• http://sourceforge.net/projec... Exploit

This module logs in to an GlassFish Server 3.1 (Open Source or Commercial) instance using a default credential, uploads, and executes commands via deploying a malicious WAR. On Glassfish 2.x, 3.0 and Sun Java System Application Server 9.x this module will try to bypass authentication instead by sending lowercase HTTP verbs.

• MODULE DETAILS
• CVE-2011-0807 Exploit
• OSVDB-71948 Exploit

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer\'s createScriptDeployment() method.

• MODULE DETAILS
• CVE-2010-0738 Exploit
• http://www.redteam-pentesting... Exploit
• https://bugzilla.redhat.com/s... Exploit

This module can be used to execute a payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:MainDeployer functionality. To accomplish this, a temporary HTTP server is created to serve a WAR archive containing our payload. This method will only work if the target server allows outbound connections to us.

• MODULE DETAILS
• CVE-2007-1036 Exploit
• CVE-2010-0738 Exploit
• OSVDB-33744 Exploit
• http://www.redteam-pentesting... Exploit
• https://bugzilla.redhat.com/s... Exploit

This module exploits an arbitrary root command execution vulnerability in the OP5 Monitor license.php. Ekelow has confirmed that OP5 Monitor versions 5.3.5, 5.4.0, 5.4.2, 5.5.0, 5.5.1 are vulnerable.

• MODULE DETAILS
• CVE-2012-0261 Exploit
• OSVDB-78064 Exploit
• http://www.ekelow.se/file_upl... Exploit
• http://www.op5.com/news/suppo... Exploit
• http://secunia.com/advisories... Exploit

When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in the query string, the string is split on '+' (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the "encoded in a system-defined manner" from the RFC) and then passes them to the CGI binary."

• MODULE DETAILS
• CVE-2012-1823 Exploit
• OSVDB-81633 Exploit
• http://eindbazen.net/2012/05/... Exploit

This module exploits an arbitrary PHP code execution flaw in the phpScheduleIt software. This vulnerability is only exploitable when the magic_quotes_gpc PHP option is 'off'. Authentication is not required to exploit the bug. Version 1.2.10 and earlier of phpScheduleIt are affected.

• MODULE DETAILS
• CVE-2008-6132 Exploit
• OSVDB-48797 Exploit
• BID-31520 Exploit
• EDB-6646 Exploit

This module exploits an arbitrary command execution vulnerability in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is inside /scripts/pagelist.php.

• MODULE DETAILS
• CVE-2011-4453 Exploit
• BID-50776 Exploit
• OSVDB-77261 Exploit
• EDB-18149 Exploit
• http://www.pmwiki.org/wiki/PI... Exploit

This module exploits an arbitrary command execution vulnerability in nmap.php and nbtscan.php scripts.

• MODULE DETAILS

This module exploits an arbitrary command execution vulnerability in the Spreecommerce search. Unvalidated input is called via the Ruby send method allowing command execution.

• MODULE DETAILS
• OSVDB-76011 Exploit
• http://spreecommerce.com/blog... Exploit

This module exploits a remote command execution vulnerability in Apache Struts versions < 2.2.0. This issue is caused by a failure to properly handle unicode characters in OGNL extensive expressions passed to the web server. By sending a specially crafted request to the Struts application it is possible to bypass the "#" restriction on ParameterInterceptors by using OGNL context variables. Bypassing this restriction allows for the execution of arbitrary Java code.

• MODULE DETAILS
• CVE-2010-1870 Exploit
• OSVDB-66280 Exploit
• EDB-14360 Exploit

This module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a PUT request. The manager application can also be abused using /manager/html/upload, but that method is not implemented in this module. NOTE: The compatible payload sets vary based on the selected target. For example, you must select the Windows target to use native Windows payloads.

• MODULE DETAILS
• CVE-2009-3843 Exploit
• OSVDB-60317 Exploit
• CVE-2009-4189 Exploit
• OSVDB-60670 Exploit
• CVE-2009-4188 Exploit
• BID-38084 Exploit
• CVE-2010-0557 Exploit
• http://www-01.ibm.com/support... Exploit
• CVE-2010-4094 Exploit
• http://www.zerodayinitiative.... Exploit
• CVE-2009-3548 Exploit
• OSVDB-60176 Exploit
• BID-36954 Exploit
• http://tomcat.apache.org/tomc... Exploit

This module exploits a vulnerability in the 'proc_deutf()' function defined in /includes/functions_vbseocp_abstract.php. User input passed through 'char_repl' POST parameter isn't properly sanitized before being used in a call to preg_replace() function which uses the 'e' modifier. This can be exploited to inject and execute arbitrary code leveraging the PHP's complex curly syntax.

• MODULE DETAILS
• OSVDB-78508 Exploit
• BID-51647 Exploit
• http://www.vbseo.com/f5/vbseo... Exploit
• EDB-18424 Exploit

This module abuses the SVG support to execute Java Code in the Squiggle Browser included in the Batik framework 1.7 through a crafted SVG file referencing a jar file. In order to gain arbitrary code execution, the browser must meet the following conditions: (1) It must support at least SVG version 1.1 or newer, (2) It must support Java code and (3) The "Enforce secure scripting" check must be disabled. The module has been tested against Windows and Linux platforms.

• MODULE DETAILS
• OSVDB-81965 Exploit
• http://www.agarri.fr/blog/ Exploit

This module takes advantage of the default configuration of the RMI Registry and RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every RMI endpoint, it can be used against both rmiregistry and rmid, and against most other (custom) RMI endpoints as well. Note that it does not work against Java Management Extension (JMX) ports since those do not support remote class loading, unless another RMI endpoint is active in the same Java process. RMI method calls do not support or require any sort of authentication.

• MODULE DETAILS
• http://download.oracle.com/ja... Exploit
• MSF-java_rmi_server Exploit

This module allows arbitrary command execution on an ephemeral port opened by Veritas NetBackup, whilst an administrator is authenticated. The port is opened and allows direct console access as root or SYSTEM from any source address.

• MODULE DETAILS
• CVE-2004-1389 Exploit
• OSVDB-11026 Exploit
• BID-11494 Exploit
• http://seer.support.veritas.c... Exploit

The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through 1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer overflow. This bug found and reported by babi. This particular exploit targets the dissect_getaddrsbyname_request function. Several other functions also contain potentially exploitable stack-based buffer overflows. The Windows version (of 1.2.5 at least) is compiled with /GS, which prevents exploitation via the return address on the stack. Sending a larger string allows exploitation using the SEH bypass method. However, this packet will usually get fragmented, which may cause additional complications. NOTE: The vulnerable code is reached only when the packet dissection is rendered. If the packet is fragmented, all fragments must be captured and reassembled to exploit this issue. This version loops, sending the packet every X seconds until the job is killed.

• MODULE DETAILS
• CVE-2010-0304 Exploit
• OSVDB-61987 Exploit
• BID-37985 Exploit
• http://www.wireshark.org/secu... Exploit
• http://anonsvn.wireshark.org/... Exploit

This module exploits a stack based buffer overflow in the ntpd and xntpd service. By sending an overly long 'readvar' request it is possible to execute code remotely. As the stack is corrupted, this module uses the Egghunter technique.

• MODULE DETAILS
• CVE-2001-0414 Exploit
• OSVDB-805 Exploit
• BID-2540 Exploit
• US-CERT-VU-970472 Exploit

This module exploits a buffer overflow in RealServer 7/8/9 and was based on Johnny Cyberpunk's THCrealbad exploit. This code should reliably exploit Linux, BSD, and Windows-based servers.

• MODULE DETAILS
• CVE-2002-1643 Exploit
• OSVDB-4468 Exploit
• http://lists.immunitysec.com/... Exploit

This module exploits a command execution vulerability in Samba versions 3.0.20 through 3.0.25rc3 when using the non-default "username map script" configuration option. By specifying a username containing shell meta characters, attackers can execute arbitrary commands. No authentication is needed to exploit this vulnerability since this option is used to map usernames prior to authentication!

• MODULE DETAILS
• CVE-2007-2447 Exploit
• OSVDB-34700 Exploit
• BID-23972 Exploit
• http://labs.idefense.com/inte... Exploit
• http://samba.org/samba/securi... Exploit

This module exploits the Wyse Rapport Hagent service by pretending to be a legitimate server. This process involves starting both HTTP and FTP services on the attacker side, then contacting the Hagent service of the target and indicating that an update is available. The target will then download the payload wrapped in an executable from the FTP service.

• MODULE DETAILS
• CVE-2009-0695 Exploit
• OSVDB-55839 Exploit
• US-CERT-VU-654545 Exploit
• http://snosoft.blogspot.com/ Exploit
• http://www.theregister.co.uk/... Exploit
• http://www.wyse.com/servicean... Exploit
• http://www.wyse.com/servicean... Exploit

This module exploits a stack buffer overflow in the NetWare PKERNEL.NLM driver's CALLIT procedure. PKERNEL.NLM is installed by default on all NetWare servers to support NFS. The PKERNEL.NLM module runs in kernel mode so a failed exploit attempt can cause the operating system to reboot.

• MODULE DETAILS
• BID-36564 Exploit
• OSVDB-58447 Exploit
• http://www.zerodayinitiative.... Exploit

This module exploits a stack buffer overflow in the Arkeia backup client for the Mac OS X platform. This vulnerability affects all versions up to and including 5.3.3 and has been tested with Arkeia 5.3.1 on Mac OS X 10.3.5.

• MODULE DETAILS
• CVE-2005-0491 Exploit
• OSVDB-14011 Exploit
• BID-12594 Exploit
• http://lists.netsys.com/piper... Exploit

This module exploits a use-after-free vulnerability in Mozilla Firefox 3.6.16. An OBJECT element, mChannel, can be freed via the OnChannelRedirect method of the nsIChannelEventSink Interface. mChannel becomes a dangling pointer and can be reused when setting the OBJECTs data attribute. This module has been tested on Mac OS X 10.6.6, 10.6.7, 10.6.8, 10.7.2 and 10.7.3.

• MODULE DETAILS
• CVE-2011-0065 Exploit
• OSVDB-72085 Exploit
• https://bugzilla.mozilla.org/... Exploit
• http://www.mozilla.org/securi... Exploit

This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload.

• MODULE DETAILS
• CVE-2006-3459 Exploit
• OSVDB-27723 Exploit
• BID-19283 Exploit

This module exploits a feature in the Distribution Packages, which are used in the Apple Software Update mechanism. This feature allows for arbitrary command execution through JavaScript. This exploit provides the malicious update server. Requests must be redirected to this server by other means for this exploit to work.

• MODULE DETAILS
• CVE-2007-5863 Exploit
• OSVDB-40722 Exploit

This module exploits a buffer overflow in the version of libtiff shipped with firmware versions 1.00, 1.01, 1.02, and 1.1.1 of the Apple iPhone. iPhones which have not had the BSD tools installed will need to use a special payload.

• MODULE DETAILS
• CVE-2006-3459 Exploit
• OSVDB-27723 Exploit
• BID-19283 Exploit

This module exploits a stack buffer overflow in the web server provided with the EvoCam program for Mac OS X. We use Dino Dai Zovi's exec-from-heap technique to copy the payload from the non-executable stack segment to heap memory. Vulnerable versions include 3.6.6, 3.6.7, and possibly earlier versions as well. EvoCam version 3.6.8 fixes the vulnerablity.

• MODULE DETAILS
• CVE-2010-2309 Exploit
• OSVDB-65043 Exploit
• EDB-12835 Exploit

This module exploits a buffer overflow in the IRC client component of UFO: Alien Invasion 2.2.1.

• MODULE DETAILS
• OSVDB-65689 Exploit
• EDB-14013 Exploit

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the szone_free() to overwrite the size() or free() pointer in initial_malloc_zones structure.

• MODULE DETAILS
• CVE-2007-2446 Exploit
• OSVDB-34699 Exploit

This is a port of noir's dtspcd exploit. This module should work against any vulnerable version of Solaris 8 (sparc). The original exploit code was published in the book Shellcoder's Handbook.

• MODULE DETAILS
• CVE-2001-0803 Exploit
• OSVDB-4503 Exploit
• BID-3517 Exploit
• http://www.cert.org/advisorie... Exploit
• http://media.wiley.com/produc... Exploit

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method (credit Ramon and Adriano), which only works with Samba versions 3.0.21-3.0.24. Additionally, this module will not work when the Samba "log level" parameter is higher than "2".

• MODULE DETAILS
• CVE-2007-2446 Exploit
• OSVDB-34699 Exploit

This module exploits a buffer overflow vulnerability in adm_build_path() function of sadmind daemon. The distributed system administration daemon (sadmind) is the daemon used by Solstice AdminSuite applications to perform distributed system administration operations. The sadmind daemon is started automatically by the inetd daemon whenever a request to invoke an operation is received. The sadmind daemon process continues to run for 15 minutes after the last request is completed, unless a different idle-time is specified with the -i command line option. The sadmind daemon may be started independently from the command line, for example, at system boot time. In this case, the -i option has no effect; sadmind continues to run, even if there are no active requests.

• MODULE DETAILS
• CVE-2008-4556 Exploit
• OSVDB-49111 Exploit
• http://risesecurity.org/advis... Exploit

This exploit targets a weakness in the way the ypupdated RPC application uses the command shell when handling a MAP UPDATE request. Extra commands may be launched through this command shell, which runs as root on the remote host, by passing commands in the format '|<command>'. Vulnerable systems include Solaris 2.7, 8, 9, and 10, when ypupdated is started with the '-i' command-line option.

• MODULE DETAILS
• CVE-1999-0209 Exploit
• OSVDB-11517 Exploit
• BID-1749 Exploit

This module uses a buffer overflow in the Solaris 'login' application to bypass authentication in the telnet daemon.

• MODULE DETAILS
• CVE-2001-0797 Exploit
• OSVDB-690 Exploit
• BID-5531 Exploit

This module exploits a malicious backdoor that was added to the VSFTPD download archive. This backdoor was introduced into the vsftpd-2.3.4.tar.gz archive between June 30th 2011 and July 1st 2011 according to the most recent information available. This backdoor was removed on July 3rd 2011.

• MODULE DETAILS
• OSVDB-73573 Exploit
• http://pastebin.com/AetT9sS5 Exploit
• http://scarybeastsecurity.blo... Exploit

This module exploits an unauthenticated remote root exploit within ctek SkyRouter 4200 and 4300.

• MODULE DETAILS

This module exploits a vulnerable resource in LifeSize Room versions 3.5.3 and 4.7.18 to inject OS commmands. LifeSize Room is an appliance and thus the environment is limited resulting in a small set of payload options.

• MODULE DETAILS
• CVE-2011-2763 Exploit
• OSVDB-75212 Exploit

This module uses a documented security weakness to execute arbitrary commands on any system running distccd.

• MODULE DETAILS
• CVE-2004-2687 Exploit
• OSVDB-13378 Exploit
• http://distcc.samba.org/secur... Exploit

This module exploits a metacharacter injection vulnerability in the FreeBSD and Solaris versions of the Zabbix agent. This flaw can only be exploited if the attacker can hijack the IP address of an authorized server (as defined in the configuration file).

• MODULE DETAILS
• CVE-2009-4502 Exploit
• OSVDB-60956 Exploit
• https://support.zabbix.com/br... Exploit

This module exploits a heap buffer overflow within versions of Exim prior to version 4.69. By sending a specially crafted message, an attacker can corrupt the heap and execute arbitrary code with the privileges of the Exim daemon. The root cause is that no check is made to ensure that the buffer is not full prior to handling '%s' format specifiers within the 'string_vformat' function. In order to trigger this issue, we get our message rejected by sending a message that is too large. This will call into log_write to log rejection headers (which is a default configuration setting). After filling the buffer, a long header string is sent. In a successful attempt, it overwrites the ACL for the 'MAIL FROM' command. By sending a second message, the string we sent will be evaluated with 'expand_string' and arbitrary shell commands can be executed. It is likely that this issue could also be exploited using other techniques such as targeting in-band heap management structures, or perhaps even function pointers stored in the heap. However, these techniques would likely be far more platform specific, more complicated, and less reliable. This bug was original found and reported in December 2008, but was not properly handled as a security issue. Therefore, there was a 2 year lag time between when the issue was fixed and when it was discovered being exploited in the wild. At that point, the issue was assigned a CVE and began being addressed by downstream vendors. An additional vulnerability, CVE-2010-4345, was also used in the attack that led to the discovery of danger of this bug. This bug allows a local user to gain root privileges from the Exim user account. If the Perl interpreter is found on the remote system, this module will automatically exploit the secondary bug as well to get root.

• MODULE DETAILS
• CVE-2010-4344 Exploit
• OSVDB-69685 Exploit
• BID-45308 Exploit
• CVE-2010-4345 Exploit
• BID-45341 Exploit
• http://seclists.org/oss-sec/2... Exploit
• http://www.gossamer-threads.c... Exploit
• http://bugs.exim.org/show_bug... Exploit
• http://git.exim.org/exim.git/... Exploit

This module exploits an arbitrary command execution vulnerability in the AWStats CGI script. AWStats v6.4 and v6.5 are vulnerable. Perl based payloads are recommended with this module. The vulnerability is only present when AllowToUpdateStatsFromBrowser is enabled in the AWstats configuration file (non-default).

• MODULE DETAILS
• CVE-2006-2237 Exploit
• OSVDB-25284 Exploit
• BID-17844 Exploit
• http://awstats.sourceforge.ne... Exploit
• EDB-1755 Exploit

This module exploits an arbitrary command execution vulnerability in the Barracuda Spam Firewall appliance. Versions prior to 3.1.18 are vulnerable.

• MODULE DETAILS
• CVE-2005-2847 Exploit
• OSVDB-19279 Exploit
• BID-14712 Exploit
• http://www.nessus.org/plugins... Exploit
• http://www.securiweb.net/wiki... Exploit

This module exploits an arbitrary command execution vulnerability in the Raxnet Cacti 'graph_view.php' script. All versions of Raxnet Cacti prior to 0.8.6-d are vulnerable.

• MODULE DETAILS
• OSVDB-17539 Exploit
• BID-14042 Exploit

The Citrix Access Gateway provides support for multiple authentication types. When utilizing the external legacy NTLM authentication module known as ntlm_authenticator the Access Gateway spawns the Samba 'samedit' command line utility to verify a user's identity and password. By embedding shell metacharacters in the web authentication form it is possible to execute arbitrary commands on the Access Gateway.

• MODULE DETAILS
• CVE-2010-4566 Exploit
• OSVDB-70099 Exploit
• BID-45402 Exploit
• http://www.vsecurity.com/reso... Exploit

This module exploits a previously unpublished vulnerability in the Dogfood CRM mail function which is vulnerable to command injection in the spell check feature. Because of character restrictions, this exploit works best with the double-reverse telnet payload. This vulnerability was discovered by LSO and affects v2.0.10.

• MODULE DETAILS
• OSVDB-54707 Exploit
• http://downloads.sourceforge.... Exploit

This module exploits a feature in the Saxon XSLT parser used by the Google Search Appliance. This feature allows for arbitrary java methods to be called. Google released a patch and advisory to their client base in August of 2005 (GA-2005-08-m). The target appliance must be able to connect back to your machine for this exploit to work.

• MODULE DETAILS
• CVE-2005-3757 Exploit
• OSVDB-20981 Exploit
• BID-15509 Exploit

This module exploits a vulnerability in the TinyMCE/tinybrowser plugin. This plugin is not secured in version 1.5.12 of joomla and allows the upload of files on the remote server. By renaming the uploaded file this vulnerability can be used to upload/execute code on the affected system.

• MODULE DETAILS
• OSVDB-64578 Exploit
• EDB-9296 Exploit
• http://developer.joomla.org/s... Exploit

This module exploits a command injection flaw within the Mitel Audio and Web Conferencing web interface.

• MODULE DETAILS
• http://www.procheckup.com/vul... Exploit
• OSVDB-69934 Exploit

This module abuses a metacharacter injection vulnerability in the Nagios3 statuswml.cgi script. This flaw is triggered when shell metacharacters are present in the parameters to the ping and traceroute commands.

• MODULE DETAILS
• CVE-2009-2288 Exploit
• OSVDB-55281 Exploit

This module exploits a vulnerability in the OpenX advertising software. In versions prior to version 2.8.2, authenticated users can upload files with arbitrary extensions to be used as banner creative content. By uploading a file with a PHP extension, an attacker can execute arbitrary PHP code. NOTE: The file must also return either "png", "gif", or "jpeg" as its image type as returned from the PHP getimagesize() function.

• MODULE DETAILS
• CVE-2009-4098 Exploit
• OSVDB-60499 Exploit
• BID-37110 Exploit
• http://archives.neohapsis.com... Exploit
• https://developer.openx.org/j... Exploit
• http://www.openx.org/docs/2.8... Exploit
• http://php.net/manual/en/func... Exploit
• http://gynvael.coldwind.pl/?i... Exploit
• http://gynvael.coldwind.pl/?i... Exploit
• http://gynvael.coldwind.pl/?i... Exploit
• http://programming.arantius.c... Exploit
• http://stackoverflow.com/ques... Exploit

osCommerce is a popular open source E-Commerce application. The admin console contains a file management utility that allows administrators to upload, download, and edit files. This could be abused to allow unauthenticated attackers to execute arbitrary code with the permissions of the webserver.

• MODULE DETAILS
• OSVDB-60018 Exploit
• http://www.milw0rm.com/exploi... Exploit

Exploits things like <?php eval($_REQUEST['evalme']); ?> It is likely that HTTP evasion options will break this exploit.

• MODULE DETAILS

This module exploits an arbitrary PHP code execution flaw in the vBulletin web forum software. This vulnerability is only present when the "Add Template Name in HTML Comments" option is enabled. All versions of vBulletin prior to 3.0.7 are affected.

• MODULE DETAILS
• CVE-2005-0511 Exploit
• BID-12622 Exploit
• OSVDB-14047 Exploit

This module exploits an arbitrary code execution flaw discovered in many implementations of the PHP XML-RPC module. This flaw is exploitable through a number of PHP web applications, including but not limited to Drupal, Wordpress, Postnuke, and TikiWiki.

• MODULE DETAILS
• CVE-2005-1921 Exploit
• OSVDB-17793 Exploit
• BID-14088 Exploit

This module exploits a vulnerability in PhpMyAdmin's setup feature which allows an attacker to inject arbitrary PHP code into a configuration file. The original advisory says the vulnerability is present in phpMyAdmin versions 2.11.x < 2.11.9.5 and 3.x < 3.1.3.1; this module was tested on 3.0.1.1. The file where our payload is written (phpMyAdmin/config/config.inc.php) is not directly used by the system, so it may be a good idea to either delete it or copy the running config (phpMyAdmin/config.inc.php) over it after successful exploitation.

• MODULE DETAILS
• CVE-2009-1151 Exploit
• OSVDB-53076 Exploit
• http://www.milw0rm.com/exploi... Exploit
• http://www.phpmyadmin.net/hom... Exploit
• http://labs.neohapsis.com/200... Exploit

This module exploits an arbitrary command execution vulnerability in the Redmine repository controller. The flaw is triggered when a rev parameter is passed to the command line of the SCM tool without adequate filtering.

• MODULE DETAILS
• OSVDB-70090 Exploit
• http://www.redmine.org/news/49 Exploit

This module exploits a command execution vulnerability in the PGP plugin of SquirrelMail. This flaw was found while quickly grepping the code after release of some information at http://www.wslabi.com/. Later, iDefense published an advisory .... Reading an email in SquirrelMail with the PGP plugin activated is enough to compromise the underlying server. Only "cmd/unix/generic" payloads were tested.

• MODULE DETAILS
• CVE-2003-0990 Exploit
• OSVDB-3178 Exploit
• http://lists.immunitysec.com/... Exploit
• http://labs.idefense.com/inte... Exploit
• http://www.wslabi.com/wabisab... Exploit

TikiWiki contains a flaw that may allow a malicious user to execute arbitrary PHP code. The issue is triggered due to the jhot.php script not correctly verifying uploaded files. It is possible that the flaw may allow arbitrary PHP code execution by uploading a malicious PHP script resulting in a loss of integrity. The vulnerability was reported in Tikiwiki version 1.9.4.

• MODULE DETAILS
• CVE-2006-4602 Exploit
• OSVDB-28456 Exploit
• BID-19819 Exploit
• http://secunia.com/advisories... Exploit

This module exploits a vulnerability in the history component of TWiki. By passing a 'rev' parameter containing shell metacharacters to the TWikiUsers script, an attacker can execute arbitrary OS commands.

• MODULE DETAILS
• CVE-2005-2877 Exploit
• OSVDB-19403 Exploit
• BID-14834 Exploit
• http://twiki.org/cgi-bin/view... Exploit

Symantec System Center Alert Management System is prone to a remote command-injection vulnerability because the application fails to properly sanitize user-supplied input.

• MODULE DETAILS
• OSVDB-66807 Exploit
• BID-41959 Exploit
• http://www.foofus.net/~spider... Exploit

This module exploits a stack buffer overflow in Intel Alert Originator Service msgsys.exe. When an attacker sends a specially crafted alert, arbitrary code may be executed.

• MODULE DETAILS
• CVE-2009-1430 Exploit
• OSVDB-54159 Exploit
• BID-34674 Exploit

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code.

• MODULE DETAILS
• CVE-2007-1070 Exploit
• OSVDB-33042 Exploit
• BID-22639 Exploit

This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060 EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code.

• MODULE DETAILS
• CVE-2007-2508 Exploit
• OSVDB-35789 Exploit
• BID-23866 Exploit

This module will execute an arbitrary payload against any system infected with the Arugizer trojan horse. This backdoor was shipped with the software package accompanying the Energizer Duo USB battery charger.

• MODULE DETAILS
• CVE-2010-0103 Exploit
• OSVDB-62782 Exploit
• US-CERT-VU-154421 Exploit

This module exploits a stack buffer overflow in the Veritas BackupExec Windows Agent software. This vulnerability occurs when a client authentication request is received with type '3' and a long password argument. Reliable execution is obtained by abusing the stack buffer overflow to smash a SEH pointer.

• MODULE DETAILS
• CVE-2005-0773 Exploit
• OSVDB-17624 Exploit
• BID-14022 Exploit
• http://www.idefense.com/appli... Exploit
• http://seer.support.veritas.c... Exploit

This module exploits a vulnerability in the CA BrightStor Discovery Service. This vulnerability occurs when a specific type of request is sent to the TCP listener on port 41523. This vulnerability was discovered by cybertronic[at]gmx.net and affects all known versions of the BrightStor product. This module is based on the 'cabrightstor_disco' exploit by HD Moore.

• MODULE DETAILS
• CVE-2005-2535 Exploit
• OSVDB-13814 Exploit
• BID-12536 Exploit
• http://archives.neohapsis.com... Exploit
• http://milw0rm.com/exploits/1131 Exploit

This module exploits a buffer overflow in Computer Associates Threat Manager for the Enterprise r8.1 By sending a specially crafted RPC request, an attacker could overflow the buffer and execute arbitrary code. In order to successfully exploit this vulnerability, you will need valid logon credentials to the target.

• MODULE DETAILS
• CVE-2007-4620 Exploit
• OSVDB-44040 Exploit
• BID-28605 Exploit

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code.

• MODULE DETAILS
• CVE-2007-0449 Exploit
• OSVDB-31593 Exploit
• BID-22342 Exploit

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could overflow the buffer and execute arbitrary code.

• MODULE DETAILS
• CVE-2007-5003 Exploit
• OSVDB-41353 Exploit
• BID-24348 Exploit

This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup for Laptops & Desktops 11.1. By sending a specially crafted request (rxsUseLicenseIni), an attacker could overflow the buffer and execute arbitrary code.

• MODULE DETAILS
• CVE-2007-3216 Exploit
• OSVDB-35329 Exploit
• BID-24348 Exploit