Exploit Database

The Rapid7 Exploit Database is an archive of Metasploit modules for publicly known exploits, 0days, remote exploits, shellcode, and more for researches and penetration testers to review. 3,000 plus modules are all available with relevant links to other technical documentation and source code. All of the modules included in the Exploit Database are also included in the Metasploit framework and utilized by our penetration testing tool, Metasploit Pro.


Displaying module details 51 - 60 of 3570 in total

VICIdial user_authorization Unauthenticated Command Execution Exploit

Disclosed: May 26, 2017

This module exploits a vulnerability in VICIdial versions 2.9 RC 1 to 2.13 RC1 which allows unauthenticated users to execute arbitrary operating system commands as the web server user if password encryption is enabled (disabled by default). When password encryption is enabled the user's password s...

VMware Workstation ALSA Config File Local Privilege Escalation Exploit

Disclosed: May 22, 2017

This module exploits a vulnerability in VMware Workstation Pro and Player on Linux which allows users to escalate their privileges by using an ALSA configuration file to load and execute a shared object as root when launching a virtual machine with an attached sound card. This module has been tested successfully ...

HPE iMC dbman RestoreDBase Unauthenticated RCE Exploit

Disclosed: May 15, 2017

This module exploits a remote command execution vulnerablity in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04. The dbman service allows unauthenticated remote users to restore a user-specified database (OpCode 10007), however the database connection username is not s...

Octopus Deploy Authenticated Code Execution Exploit

Disclosed: May 15, 2017

This module can be used to execute a payload on an Octopus Deploy server given valid credentials or an API key. The payload is executed as a powershell script step on the Octopus Deploy server during a deployment.

LabF nfsAxe 3.7 FTP Client Stack Buffer Overflow Exploit

Disclosed: May 15, 2017

This module exploits a buffer overflow in the LabF nfsAxe 3.7 FTP Client allowing remote code execution.

HPE iMC dbman RestartDB Unauthenticated RCE Exploit

Disclosed: May 15, 2017

This module exploits a remote command execution vulnerablity in Hewlett Packard Enterprise Intelligent Management Center before version 7.3 E0504P04. The dbman service allows unauthenticated remote users to restart a user-specified database instance (OpCode 10008), however the instance ID is not sanitized...

Windows UAC Protection Bypass (Via FodHelper Registry Key) Exploit

Disclosed: May 12, 2017

This module will bypass Windows 10 UAC by hijacking a special key in the Registry under the current user hive, and inserting a custom command that will get invoked when the Windows fodhelper.exe application is launched. It will spawn a second shell that has the UAC flag turned off. This module modifies a ...

Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free Exploit

Disclosed: May 10, 2017

This module exploits a use-after-free vulnerability in the handling of SSL NDMP connections in Veritas/Symantec Backup Exec's Remote Agent for Windows. When SSL is re-established on a NDMP connection that previously has had SSL established, the BIO struct for the connection's previous SSL session is reused, even though it...

Intel AMT Digest Authentication Bypass Scanner Exploit

Disclosed: May 05, 2017

This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest (CVE-2017-5689). This service can be found on ports 16992, 16993 (tls), 623, and 624 (tls).

WordPress PHPMailer Host Header Command Injection Exploit

Disclosed: May 03, 2017

This module exploits a command injection vulnerability in WordPress version 4.6 with Exim as an MTA via a spoofed Host header to PHPMailer, a mail-sending library that is bundled with WordPress. A valid WordPress username is required to exploit the vulnerability. Additionally, due to the altered Host header, expl...