Exploit Database

The Rapid7 Exploit Database is an archive of Metasploit modules for publicly known exploits, 0days, remote exploits, shellcode, and more for researches and penetration testers to review. 3,000 plus modules are all available with relevant links to other technical documentation and source code. All of the modules included in the Exploit Database are also included in the Metasploit framework and utilized by our penetration testing tool, Metasploit Pro.


Displaying module details 191 - 200 of 3701 in total

MagniComp SysInfo mcsiwrapper Privilege Escalation Exploit

Disclosed: September 23, 2016

This module attempts to gain root privileges on systems running MagniComp SysInfo versions prior to 10-H64. The .mcsiwrapper suid executable allows loading a config file using the '--configfile' argument. The 'ExecPath' config directive is used to set the executable load path. This module abuses this functionalit...

BuilderEngine Arbitrary File Upload Vulnerability and execution Exploit

Disclosed: September 18, 2016

This module exploits a vulnerability found in BuilderEngine 3.5.0 via elFinder 2.0. The jquery-file-upload plugin can be abused to upload a malicious file, which would result in arbitrary remote code execution under the context of the web server.

Metasploit Web UI Static secret_key_base Value Exploit

Disclosed: September 15, 2016

This module exploits the Web UI for Metasploit Community, Express and Pro where one of a certain set of Weekly Releases have been applied. These Weekly Releases introduced a static secret_key_base value. Knowledge of the static secret_key_base value allows for deserialization of a crafted Ruby Object, achieving co...

Telpho10 Backup Credentials Dumper Exploit

Disclosed: September 02, 2016

This module exploits a vulnerability present in all versions of Telpho10 telephone system appliance. This module generates a configuration backup of Telpho10, downloads the file and dumps the credentials for admin login, phpmyadmin, phpldapadmin, etc. This module has been successfully tested on the appliance versi...

WebKit not_number defineProperties UAF Exploit

Disclosed: August 25, 2016

This module exploits a UAF vulnerability in WebKit's JavaScriptCore library.

Metasploit Web UI Diagnostic Console Command Execution Exploit

Disclosed: August 23, 2016

This module exploits the "diagnostic console" feature in the Metasploit Web UI to obtain a reverse shell. The diagnostic console is able to be enabled or disabled by an administrator on Metasploit Pro and by an authenticated user on Metasploit Express and Metasploit Community. When enabled, the diagnostic...

Windows Escalate UAC Protection Bypass (Via Eventvwr Registry Key) Exploit

Disclosed: August 15, 2016

This module will bypass Windows UAC by hijacking a special key in the Registry under the current user hive, and inserting a custom command that will get invoked when the Windows Event Viewer is launched. It will spawn a second shell that has the UAC flag turned off. This module modifies a registry key, but cleans...

NodeJS Debugger Command Injection Exploit

Disclosed: August 15, 2016

This module uses the "evaluate" request type of the NodeJS V8 debugger protocol (version 1) to evaluate arbitrary JS and call out to other system commands. The port (default 5858) is not exposed non-locally in default configurations, but may be exposed either intentionally or via misconfiguration.

AF_PACKET chocobo_root Privilege Escalation Exploit

Disclosed: August 12, 2016

This module exploits a race condition and use-after-free in the packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in the Linux kernel to execute code as root (CVE-2016-8655). The bug was initially introduced in 2011 and patched in 2016 in version 4.4.0-53.74, potentially affecting a large number of k...

ColoradoFTP Server 1.3 Build 8 Directory Traversal Information Disclosure Exploit

Disclosed: August 11, 2016

This module exploits a directory traversal vulnerability found in ColoradoFTP server version <= 1.3 Build 8. This vulnerability allows an attacker to download and upload arbitrary files from the server GET/PUT command including file system traversal strings starting with '\\'. The server is written in Java and therefore p...