Exploit Database

The Rapid7 Exploit Database is an archive of Metasploit modules for publicly known exploits, 0days, remote exploits, shellcode, and more for researches and penetration testers to review. 3,000 plus modules are all available with relevant links to other technical documentation and source code. All of the modules included in the Exploit Database are also included in the Metasploit framework and utilized by our penetration testing tool, Metasploit Pro.

Displaying module details 1 - 10 of 3438 in total

Riverbed SteelHead VCX File Read Exploit

Disclosed: June 01, 2017

This module exploits an authenticated arbitrary file read in the log module's filter engine. SteelHead VCX (VCX255U) version 9.6.0a was confirmed as vulnerable.

ScadaBR Credentials Dumper Exploit

Disclosed: May 28, 2017

This module retrieves credentials from ScadaBR, including service credentials and unsalted SHA1 password hashes for all users, by invoking the 'EmportDwr.createExportData' DWR method of Mango M2M which is exposed to all authenticated users regardless of privilege level. This module has been tested success...

Octopus Deploy Authenticated Code Execution Exploit

Disclosed: May 15, 2017

This module can be used to execute a payload on an Octopus Deploy server given valid credentials or an API key. The payload is execued as a powershell script step on the Octopus Deploy server during a deployment.

Windows UAC Protection Bypass (Via FodHelper Registry Key) Exploit

Disclosed: May 12, 2017

This module will bypass Windows 10 UAC by hijacking a special key in the Registry under the current user hive, and inserting a custom command that will get invoked when the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC flag turned off. This module modifies a ...

Intel AMT Digest Authentication Bypass Scanner Exploit

Disclosed: May 05, 2017

This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest (CVE-2017-5689). This service can be found on ports 16992, 16993 (tls), 623, and 624(tls).

Serviio Media Server checkStreamUrl Command Execution Exploit

Disclosed: May 03, 2017

This module exploits an unauthenticated remote command execution vulnerability in the console component of Serviio Media Server versions 1.4 to 1.8 on Windows operating systems. The console service (on port 23423 by default) exposes a REST API which which does not require authentication. The 'action' API...

WordPress PHPMailer Host Header Command Injection Exploit

Disclosed: May 03, 2017

This module exploits a command injection vulnerability in WordPress version 4.6 with Exim as an MTA via a spoofed Host header to PHPMailer, a mail-sending library that is bundled with WordPress. A valid WordPress username is required to exploit the vulnerability. Additionally, due to the altered Host header, expl...

Crypttech CryptoLog Remote Code Execution Exploit

Disclosed: May 03, 2017

This module exploits a SQL injection and command injection vulnerability in the PHP version of CryptoLog. An unauthenticated user can execute a terminal command under the context of the web user. These vulnerabilities are no longer present in the ASP.NET version CryptoLog, available since 2009. CryptoLog's login.php endp...

Ghostscript Type Confusion Arbitrary Command Execution Exploit

Disclosed: April 27, 2017

This module exploits a type confusion vulnerability in Ghostscript that can be exploited to obtain arbitrary command execution. This vulnerability affects Ghostscript version 9.21 and earlier and can be exploited through libraries such as ImageMagick and Pillow.

WePresent WiPG-1000 Command Injection Exploit

Disclosed: April 20, 2017

This module exploits a command injection vulnerability in an undocumented CGI file in several versions of the WePresent WiPG-1000 devices. Version was confirmed vulnerable, patched this vulnerability.