The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.
This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\
| REMOTE_CONTENT |
Content of the remote file (default: Hello from CVE-2011-1774) |
| REMOTE_PATH |
Location of the remote file (default: flag.txt) |
| SRVHOST |
The local host to listen on. This must be an address on the local machine or 0.0.0.0 (default: 0.0.0.0) |
| SRVPORT |
The local port to listen on. (default: 8080) |
| SSL |
Negotiate SSL for incoming connections |
| SSLCert |
Path to a custom SSL certificate (default is randomly generated) |
| SSLVersion |
Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) (default: SSL3) |
| URIPATH |
The URI to use for this exploit (default is random) |
| ListenerComm |
The specific communication channel to use for this service |
| VERBOSE |
Enable detailed status messages |
| WORKSPACE |
Specify the workspace for this module |
| HTML::base64 |
Enable HTML obfuscation via an embeded base64 html object (IE not supported) (accepted: none, plain, single_pad, double_pad, random_space_injection) |
| HTML::javascript::escape |
Enable HTML obfuscation via HTML escaping (number of iterations) |
| HTML::unicode |
Enable HTTP obfuscation via unicode (accepted: none, utf-16le, utf-16be, utf-16be-marker, utf-32le, utf-32be) |
| HTTP::chunked |
Enable chunking of HTTP responses via "Transfer-Encoding: chunked" |
| HTTP::compression |
Enable compression of HTTP responses via content encoding (accepted: none, gzip, deflate) |
| HTTP::header_folding |
Enable folding of HTTP headers |
| HTTP::junk_headers |
Enable insertion of random junk HTTP headers |
| HTTP::server_name |
Configures the Server header of all outgoing replies |
| TCP::max_send_size |
Maximum tcp segment size. (0 = disable) |
| TCP::send_delay |
Delays inserted before every send. (0 = disable) |