Exploit Database

The Rapid7 Exploit Database is an archive of Metasploit modules for publicly known exploits, 0days, remote exploits, shellcode, and more for researches and penetration testers to review. 3,000 plus modules are all available with relevant links to other technical documentation and source code. All of the modules included in the Exploit Database are also included in the Metasploit framework and utilized by our penetration testing tool, Metasploit Pro.

Displaying module details 41 - 50 of 3513 in total

Mercurial Custom hg-ssh Wrapper Remote Code Exec Exploit

Disclosed: April 18, 2017

This module takes advantage of custom hg-ssh wrapper implementations that don't adequately validate parameters passed to the hg binary, allowing users to trigger a Python Debugger session, which allows arbitrary Python code execution.

MantisBT password reset Exploit

Disclosed: April 16, 2017

MantisBT before 1.3.10, 2.2.4, and 2.3.1 are vulnerable to unauthenticated password reset.

Huawei HG532n Command Injection Exploit

Disclosed: April 15, 2017

This module exploits a command injection vulnerability in the Huawei HG532n routers provided by TE-Data Egypt, leading to a root shell. The router's web interface has two kinds of logins, a "limited" user:user login given to all customers and an admin mode. The limited mode is used here to expose the router's tel...

Microsoft Office Word Malicious Hta Execution Exploit

Disclosed: April 14, 2017

This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how a olelink object can make a http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 201...

Trend Micro Threat Discovery Appliance admin_sys_time.cgi Remote Command Execution Exploit

Disclosed: April 10, 2017

This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552). The second is a cmdi flaw using the timezone parameter in the admin_s...

Quest Privilege Manager pmmasterd Buffer Overflow Exploit

Disclosed: April 09, 2017

This modules exploits a buffer overflow in the Quest Privilege Manager, a software used to integrate Active Directory with Linux and Unix systems. The vulnerability exists in the pmmasterd daemon, and can only triggered when the host has been configured as a policy server ( Privilege Manager for Unix or Quest Sudo...

Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability Exploit

Disclosed: April 07, 2017

This module exploits an OS Command Injection vulnerability in Satel Iberia SenNet Data Loggers & Electricity Meters to perform arbitrary command execution as 'root'.

Windows Escalate UAC Protection Bypass (In Memory Injection) abusing WinSXS Exploit

Disclosed: April 06, 2017

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off by abusing the way "WinSxS" works in Windows systems. This module uses the Reflective DLL Injection technique to drop only the DLL payload bina...

MediaWiki SyntaxHighlight extension option injection vulnerability Exploit

Disclosed: April 06, 2017

This module exploits an option injection vulnerability in the SyntaxHighlight extension of MediaWiki. It tries to create & execute a PHP file in the document root. The USERNAME & PASSWORD options are only needed if the Wiki is configured as private. This vulnerability affects any MediaWiki installation with SyntaxHighlig...

Microsoft IIS WebDav ScStoragePathFromUrl Overflow Exploit

Disclosed: March 26, 2017

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wi...