Exploit Database

The Rapid7 Exploit Database is an archive of Metasploit modules for publicly known exploits, 0days, remote exploits, shellcode, and more for researches and penetration testers to review. 3,000 plus modules are all available with relevant links to other technical documentation and source code. All of the modules included in the Exploit Database are also included in the Metasploit framework and utilized by our penetration testing tool, Metasploit Pro.

Displaying module details 1 - 10 of 3495 in total

Easy Chat Server User Registeration Buffer Overflow (SEH) Exploit

Disclosed: October 09, 2017

This module exploits a buffer overflow during user registration in Easy Chat Server software.

Apache Struts 2 REST Plugin XStream RCE Exploit

Disclosed: September 05, 2017

Apache Struts versions 2.1.2 - 2.3.33 and Struts 2.5 - Struts 2.5.12, using the REST plugin, are vulnerable to a Java deserialization attack in the XStream library.

Disk Pulse Enterprise GET Buffer Overflow Exploit

Disclosed: August 25, 2017

This module exploits an SEH buffer overflow in Disk Pulse Enterprise 9.9.16. If a malicious user sends a crafted HTTP GET request it is possible to execute a payload that would run under the Windows NT AUTHORITY\SYSTEM account.

Malicious Git HTTP Server For CVE-2017-1000117 Exploit

Disclosed: August 10, 2017

This module exploits CVE-2017-1000117, which affects Git version 2.7.5 and lower. A submodule of the form 'ssh://' can be passed parameters from the username incorrectly. This can be used to inject commands to the operating system when the submodule is cloned. This module creates a fake git repository whi...

QNAP Transcode Server Command Execution Exploit

Disclosed: August 06, 2017

This module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the 'rmfile' command. This module was tested successfully on a QNAP TS-431 with firmware version

SMBLoris NBSS Denial of Service Exploit

Disclosed: July 29, 2017

The SMBLoris attack consumes large chunks of memory in the target by sending SMB requests with the NetBios Session Service(NBSS) Length Header value set to the maximum possible value. By keeping these connections open and initiating large numbers of these sessions, the memory does not get freed, and the server gri...

PlugX Controller Stack Overflow Exploit

Disclosed: July 27, 2017

This module exploits a Stack buffer overflow in the PlugX Controller (C2 server)

Gh0st Client buffer Overflow Exploit

Disclosed: July 27, 2017

This module exploits a Memory buffer overflow in the Gh0st client (C2 server)

Docker Daemon - Unprotected TCP Socket Exploit Exploit

Disclosed: July 25, 2017

Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp with tls but without tls-auth), an attacker can create a Docker container with the '/' path mounted with read/write permissions on the host server that is running the Docker container. As the Docker container executes command as uid 0 it is hono...

Nitro Pro PDF Reader Javascript API Remote Code Execution Exploit

Disclosed: July 24, 2017

This module exploits an unsafe Javascript API implemented in Nitro and Nitro Pro PDF Reader version 11. The saveAs() Javascript API function allows for writing arbitrary files to the file system. Additionally, the launchURL() function allows an attacker to execute local files on the file system and bypass the securi...