• Close
  • Exploit Database

    The Rapid7 Exploit Database is an archive of Metasploit modules for publicly known exploits, 0days, remote exploits, shellcode, and more for researches and penetration testers to review. 3,000 plus modules are all available with relevant links to other technical documentation and source code. All of the modules included in the Exploit Database are also included in the Metasploit framework and utilized by our penetration testing tool, Metasploit Pro.

    Displaying module details 41 - 50 of 3282 in total

    Regsvr32.exe (.sct) Application Whitelisting Bypass Server Exploit

    Disclosed: April 19, 2016

    This module simplifies the Regsvr32.exe Application Whitelisting Bypass technique. The module creates a web server that hosts an .sct file. When the user types the provided regsvr32 command on a system, regsvr32 will request the .sct file and then execute the included PowerShell command. This command then downloads and ex...

    HP Data Protector Encrypted Communication Remote Command Execution Exploit

    Disclosed: April 18, 2016

    This module exploits a well known remote code execution exploit after establishing encrypted control communications with a Data Protector agent. This allows exploitation of Data Protector agents that have been configured to only use encrypted control communications. This exploit works by executing the payload with Micros...

    op5 v7.1.9 Configuration Command Execution Exploit

    Disclosed: April 08, 2016

    op5 an open source network monitoring software. The configuration page in version 7.1.9 and below allows the ability to test a system command, which can be abused to run arbitrary code as an unpriv user.

    ExaGrid Known SSH Key and Default Password Exploit

    Disclosed: April 07, 2016

    ExaGrid ships a public/private key pair on their backup appliances to allow passwordless authentication to other ExaGrid appliances. Since the private key is easily retrievable, an attacker can use it to gain unauthorized remote access as root. Additionally, this module will attempt to use the default password fo...

    Apache Continuum Arbitrary Command Execution Exploit

    Disclosed: April 06, 2016

    This module exploits a command injection in Apache Continuum <= 1.4.2. By injecting a command into the installation.varValue POST parameter to /continuum/saveInstallation.action, a shell can be spawned.

    Novell ServiceDesk Authenticated File Upload Exploit

    Disclosed: March 30, 2016

    This module exploits an authenticated arbitrary file upload via directory traversal to execute code on the target. It has been tested on versions 6.5 and 7.1.0, in Windows and Linux installations of Novell ServiceDesk, as well as the Virtual Appliance provided by Novell.

    HTTP Client Information Gather Exploit

    Disclosed: March 22, 2016

    This module gathers information about a browser that exploits might be interested in, such as OS name, browser version, plugins, etc. By default, the module will return a fake 404, but you can customize this output by changing the Custom404 datastore option, and redirect to an external web page.

    MS16-032 Secondary Logon Handle Privilege Escalation Exploit

    Disclosed: March 21, 2016

    This module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.

    Kaltura Remote PHP Code Execution Exploit

    Disclosed: March 15, 2016

    This module exploits an Object Injection vulnerability in Kaltura. By exploiting this vulnerability, unauthenticated users can execute arbitrary code under the context of the web server user. Kaltura has a module named keditorservices that takes user input and then uses it as an unserialized function parameter. T...

    Exim "perl_startup" Privilege Escalation Exploit

    Disclosed: March 10, 2016

    This module exploits a Perl injection vulnerability in Exim < 4.86.2 given the presence of the "perl_startup" configuration parameter.